Use DNS Filtering Services
Description
Use DNS filtering services on all enterprise assets to block access to known malicious domains.
Implementation Checklist
Tool Recommendations
Cloud-native secure web gateway with inline inspection, URL filtering, sandboxing, and DLP for web traffic
Zscaler · Per-user subscription
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Malware Callback to Known Command-and-Control Domains
ConfidentialityMalware on enterprise assets communicates with known malicious domains for command-and-control instructions, payload downloads, and data exfiltration, and without DNS filtering these connections succeed unimpeded.
Phishing Domain Access Leading to Credential Theft
ConfidentialityUsers click phishing links that resolve to known malicious domains mimicking legitimate login pages, and without DNS-level blocking these domains are freely accessible, enabling credential harvesting at scale.
Cryptojacking and Malvertising Domain Connections
AvailabilityEnterprise assets connect to domains hosting cryptomining scripts or malicious advertisements that deliver drive-by downloads, consuming resources and potentially installing malware because no DNS filtering blocks these known threats.
Vulnerabilities (When Safeguard Absent)
No DNS Filtering Service Deployed
Enterprise assets resolve DNS queries without any filtering, allowing connections to known malicious domains, phishing infrastructure, and threat actor command-and-control servers without any prevention or alerting.
DNS Filtering Bypass via Direct IP or External DNS
Even where DNS filtering exists, endpoints can bypass it by using hardcoded IP addresses or external DNS resolvers (DoH, DoT) that are not blocked at the network perimeter, negating the protection.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | DNS filtering configuration and block statistics | Monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |