Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Zone Signing Key (ZSK) rollover interval must be configured to less than two months.
Description
Discussion Text
An attacker that has compromised a ZSK can use that key only during the KSK's signature validity interval. An attacker that has compromised a KSK can use that key for only as long as the signature interval of the RRSIG covering the DS RR in the delegating parent. These validity periods should be short, which will require frequent re-signing.
To minimize the impact of a compromised ZSK, a zone administrator should set a rollover interval of no less than two months for the ZSK.
To minimize the impact of a compromised ZSK, a zone administrator should set a rollover interval of no less than two months for the ZSK.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.