CyberStrikeus/CyberStrike - Page 36

cis-bind-v100-2-3

Lock the BIND User Account (Automated)

cis-bind-v100-2-4

Set root Ownership of BIND Directories (Automated)

cis-bind-v100-2-5

Set root Ownership of BIND Configuration Files (Automated)

cis-bind-v100-2-6

Set Group named or root for BIND Directories and Files (Automated)

cis-bind-v100-2-7

Set Group Read-Only for BIND Files and Non-Runtime Directories (Automated)

cis-bind-v100-2-8

Set Other Permissions Read-Only for All BIND Directories and Files (Automated)

cis-bind-v100-2-9

Isolate BIND with chroot'ed Subdirectory (Automated)

cis-bind-v100-3-1

Ignore Erroneous or Unwanted Queries (Automated)

cis-bind-v100-3-2

Restrict Recursive Queries (Automated)

cis-bind-v100-3-3

Restrict Query Origins (Manual)

cis-bind-v100-3-4

Restrict Queries of the Cache (Automated)

cis-bind-v100-4-1

Use TSIG Keys 256 Bits in Length (Automated)

cis-bind-v100-4-2

Include Cryptographic Key Files (Automated)

cis-bind-v100-4-3

Use Unique Keys for Each Pair of Hosts (Automated)

cis-bind-v100-4-4

Restrict Access to All Key Files (Automated)

cis-bind-v100-4-5

Protect TSIG Key Files During Deployment (Manual)

cis-bind-v100-5-1

Securely Authenticate Zone Transfers (Automated)

cis-bind-v100-5-2

Securely Authenticate Dynamic Updates (Automated)

cis-bind-v100-5-3

Securely Authenticate Update Forwarding (Automated)

cis-bind-v100-6-1

Hide BIND Version String (Automated)

cis-bind-v100-6-2

Hide Nameserver ID (Automated)

cis-bind-v100-7-1

Do Not Define a Static Source Port (Automated)

cis-bind-v100-7-2

Enable DNSSEC Validation (Automated)

cis-bind-v100-7-3

Disable the dnssec-accept-expired Option (Automated)

cis-bind-v100-7-4

Ensure Either SPF or DKIM DNS Records are Configured (Automated)

cis-bind-v100-8-1

Install the Haveged Package for Enhanced Entropy (Automated)

cis-bind-v100-8-2

Ensure Signing Keys are Generated with a Secure Algorithm (Automated)

cis-bind-v100-8-3

Ensure Any Signing Keys using RSA Have a Length of 2048 or Greater (Automated)

cis-bind-v100-8-4

Restrict Access to Zone and Key Signing Keys (Automated)

cis-bind-v100-8-5

Ensure each Zone has a Valid Digital Signature (Manual)

cis-bind-v100-8-6

Ensure Full Digital Chain of Trust can be Validated (Automated)

cis-bind-v100-8-7

Ensure Signing Keys are Unique (Automated)

cis-bind-v100-8-8

Ensure Zones are Signed with NSEC or NSEC3 (Automated)

cis-bind-v100-9-1

Apply Applicable Updates (Automated)

cis-bind-v100-9-2

Configure a Logging File Channel (Automated)

cis-bind-v100-9-3

Configure a Logging Syslog Channel (Automated)

cis-bind-v100-9-4

Disable the HTTP Statistics Server (Automated)

cis-bind-v100-9-5

Response Rate Limiting and DDOS Mitigation (Automated)

cis-bind-v100-9-6

Ensure Signing Keys are Scheduled to be Replaced Periodically (Automated)

cis-bind9-v301-1-1

Use a Split-Horizon Architecture (Manual)