V-285254

Discussion

A DoS is a condition where a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Individuals of concern can include hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyberattacks on third parties. Applications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks. When it comes to DoS attacks, most of the attention is paid to ensuring that systems and applications are not victims of these attacks. A DoS attack against the DNS infrastructure has the potential to cause a DoS to all network users. As the DNS is a distributed backbone service of the internet, numerous forms of attacks result in DoS. Some potential DoS attacks against the DNS include malformed packet flood, spoofed source addresses, and distributed DoS, and the DNS can be exploited to launch amplification attacks upon other systems. While it is true that those accountable for systems want to ensure they are not affected by a DoS attack, they also need to ensure their systems and applications are not used to launch such an attack against others. To that end, a variety of technologies exist to limit the effects of DoS attacks, such as careful configuration of resolver and recursion functionality. DNS administrators must take the steps needed to ensure other systems and tools cannot use exploits to launch DoS attacks against other systems and networks. An example would be designing the DNS architecture to include mechanisms that throttle DNS traffic and resources so that users/other DNS servers are not able to generate unlimited DNS traffic via the application.

Check Content

Verify Infoblox external logging is configured to restrict the ability of individuals to use the DNS service member to launch DoS attacks against other information systems.

1. Navigate to Data Management >> DNS tab.
2. Click "Grid DNS Properties" (Toolbar menu). 
3. For external authoritative DNS service members: 
a. Select the Queries >> Basic tab.
b. Verify the "Allow Recursion" checkbox is not configured.

For internal DNS service members: 
a. On the "Updates" tab, verify an Access Control List (ACL) or Access Control Entry (ACE) for "Allow updates from" is configured.
b. Verify the "Allow Recursion" checkbox is not configured.

For internal DNS service members: 
a. On the "Updates" tab, verify an ACL or ACE for "Allow updates from" is configured.
b. On the "Queries" tab, verify that either an ACL or ACE for "Allow queries from" is configured. 

4. When complete, click "Cancel" to save the changes and exit the "Properties" screen.

If there is an open recursive DNS service on external DNS service members, or unrestricted access to internal DNS service members, this is a finding.