Best Practice Detail

13-12-8047

Network Operators, Service Providers and Public Safety should provide DNS DoS protection by implementing protection techniques such as: 1) increase DNS resiliency through redundancy and robust network connections, 2) Have separate name servers for internal and external traffic as well as critical infrastructure, such as OAM&P and signaling/control networks, 3) Where feasible, separate proxy servers from authoritative name servers, 4) Protect DNS information by protecting master name servers with appropriately configured firewall/filtering rules, implement secondary masters for all name resolution, and using Bind ACLs to filter zone transfer requests. This applies to Public Safety only in an NG9-1-1 environment.

Status: Rollover New

References/Comments: RFC-2870, ISO/IEC 15408, ISO 17799, US-CERT \"Securing an Internet Name Server\" (http://www.cert.org/archive/pdf/dns.pdf).

Historical events:

• Network Operators
• Service Providers
• Public Safety
• Internet/Data
• Cyber Security
• Network Elements
• Network Operations
• Public Safety Service
• CSRIC VII: Rollover New In CSRIC VII