Best Practice Detail

13-13-8527

Network Operators, Service Providers, Public Safety and Government should prepare a disaster recovery plan to implement upon DNS server compromise. The plan should incorporate procedures to, first flush the DNS cache and, failing that, implement elements that may include but are not limited to: 1) bring-on additional hot or cold spare capacity, 2) bring up a known good DNS server from scratch on different hardware, 3) Reload and reboot machine to a known good DNS server software (from bootable CD or spare hard drive), 4) Reload name resolution records from a trusted back-up. After the DNS is again working, conduct a post-mortem of the attack/response. This applies to Public Safety only in an NG9-1-1 environment.

Status: Edited

References/Comments: RFC-2870, ISO/IEC, 15408, ISO 17799, US-CERT \\\"Securing an Internet Name Server\\\".

Historical events:

Network Operators
Service Providers
Public Safety
Government
Cable
Internet/Data
Satellite
Wireless
Wireline
Cyber Security
Disaster Recovery
Emergency Preparedness
Public Safety Service
CSRIC VII: Edited By WG 4 In CSRIC VII