Configure Trusted DNS Servers on Enterprise Assets
Description
Configure trusted DNS servers on enterprise assets. Example implementations include: configuring assets to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
DNS Hijacking Redirecting Users to Malicious Sites
IntegrityAttackers compromise or spoof DNS responses to redirect enterprise users to phishing sites, malware distribution points, or man-in-the-middle proxy servers.
DNS Tunneling for Data Exfiltration
ConfidentialityAttackers use unauthorized or unmonitored DNS servers to tunnel data out of the network via DNS queries, bypassing content filtering and network monitoring controls.
Vulnerabilities (When Safeguard Absent)
No Trusted DNS Server Configuration
Without configured trusted DNS servers, enterprise assets may use arbitrary or attacker-controlled DNS resolvers, enabling phishing, malware delivery, and traffic interception.
DNS Resolution via Uncontrolled External Resolvers
Assets resolving DNS through public or ISP-provided servers bypass enterprise DNS security controls including filtering, logging, and sinkholing of malicious domains.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Record | Access review/recertification records with sign-off | Quarterly |
| Technical | Access control configuration evidence (RBAC settings, group memberships) | Reviewed quarterly |
| Technical | DNS filtering configuration and block statistics | Monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |