Cloud DNS should have DNSSEC enabled

문서 > Datadog 보안 > OOTB Rules > Cloud DNS should have DNSSEC enabled

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Cloud Domain Name System (DNS) is a fast, reliable, and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking, man-in-the-middle attacks, and more.

Rationale

Domain Name System Security Extensions (DNSSEC) adds security to the DNS protocol by enabling the DNS responses to be validated. A trustworthy DNS that translates a domain name like www.example.com into its associated IP address is an increasingly important building block for modern web-based applications.

Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records to prevent attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites.

By default, DNSSEC is not enabled.

Remediation

From the console

Navigate to the Cloud DNS page.
For each Type Public zone, set DNSSEC to On.

From the command line

Use this command to enable DNSSEC for Cloud DNS Zone Name:

gcloud dns managed-zones update ZONE_NAME --dnssec-state on