Subcontrol 8.7

[adammontville]

Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious domains.

Measures

M1 = # of url to test
M2 = # of DNS query in log

Metrics

Boolean value = 0 if (M1 == M2); otherwise 1;

[apiperCIS]

This one seems to get complicated quickly. It's also worth thinking about it in the context of 7.7 where we're recommending using an external DNS filtering service. I've done some research and chatted with Phil. We brainstormed about 3 different ways of doing this (which I know gets into the "how", but sometimes it's necessary to think about "how" these things are done in order to make sure the "what" that we propose makes sense).

Some possible ways of doing this: 1) Organization has internal DNS server(s) that log the DNS requests (before sending those DNS requests on to the external service) 2) DNS requests are logged on the endpoints (potentially by an EDR, etc.) and then those logs aggregated somewhere (SIEM, etc.) 3) detect and log the DNS requests at the network level (NIDS, etc.)

It seems like this sub-control measure should be able to be automated, but if we're coming at it from the configuration checking approach, it's hard to know what type of configuration to check. If we just say, point at the DNS logs with an input, it would just be a binary - yes there are logs, no there aren't, which seems kind of watered down. Any thoughts on all of this?

[wmunyan]

enable query logging within the DNS system what's the scope? focus on endpoints but include servers for organizations that have their own resolver

Assumption:

• The organization maintains its own internal DNS server

Inputs:

• The list of internal DNS servers
• The organization's DNS configuration policy

Operations:

• For each internal DNS server (Input 1), compare the server's DNS configuration with the organization's DNS configuration policy

Measures:

• M1 = The number of internal DNS servers
• M2 = The number of internal DNS servers matching the organization's configuration policy

Metrics:

• DNS Configuration Coverage = M2/M1