OpenControls Logo

STIG Viewer

STIGViewer Support

The Infoblox system must implement cryptographic mechanisms to detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-214196IDNS-7X-000600SV-214196r612370_ruleCCI-002421medium
Description
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions which have common application in digital signatures, checksums, and message authentication codes. Confidentiality is not an objective of DNS, but integrity is. DNSSEC and TSIG/SIG(0) both digitally sign DNS information to authenticate its source and ensure its integrity.
STIGDate
Infoblox 7.x DNS Security Technical Implementation Guide2020-12-10

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-01Use of Cryptographic Controls
0.50
CRY-01.1Alternate Physical Protection
0.50
CRY-03Transmission Confidentiality
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-11Re-authentication
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3Device Identification and Authentication
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.8
1.00
CCI1 mapping
CCI-002421
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50
PR.DS-10
0.50

Details

Check Text (C-214196r612370_chk)

Note: For Infoblox DNS systems on a Classified network, this requirement is Not Applicable. Verify that DNSSEC is enabled by navigating to Data Management >> DNS >> Grid DNS Properties tab. Toggle Advanced Mode and review the "DNSSEC" tab to verify DNSSEC is enabled. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC is not enabled, this is a finding.

Fix Text (F-15409r295852_fix)

Enable DNSSEC is by navigating to Data Management >> DNS >> Grid DNS properties tab. Toggle Advanced Mode and select the "DNSSEC" tab. Enable DNSSEC by selecting the check box. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. Perform a service restart if necessary.