CISCO CSS DNS

The CISCO CSS DNS (V4 R1) has 10 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

10STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V4 · R1

CurrentPublished Fri Jan 22 2016

The CSS DNS does not transmit APP session data over an out-of-band network if one is available.

CISCO CSS DNS

Assessment Title

Rule Text

The CSS DNS does not transmit APP session data over an out-of-band network if one is available.

Description

Discussion Text

One can also limit APP communication to an out of band network, which would make it considerably more difficult for adversaries to spoof the addresses of peers or hijack APP sessions.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-4509

Rule

SV-4509r1_rule

Severity

low

Rule Version

DNS0920

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

In the presence of the reviewer, the CSS DNS administrator should enter the following command while in global configuration mode:

show app session

Instruction:  Ensure Application Peering Protocol (APP) session data is not sent over an out-of-band network.  If APP session data is sent over an out-of-band network, then this is a finding.

Implementation Procedure

Fix Text

The CSS DNS administrator should use the following command while in global configuration mode; app session 1.2.3.4 (sample IP address), to configure CSS to only transmit session data over an out-of-band network, if one is available.

STIG check 8 of 10 in the CISCO CSS DNS STIG checklist

← Previous · V-4508Zones are delegated with the CSS DNS.Next · V-4510 →Forwarders are not disabled on the CSS DNS.