CMMC SC.4.199 - Use Threat Intelligence to Manage DNS Requests

CMMC SC.4.199 - Use Threat Intelligence to Manage DNS Requests

Requirement text: SC.4.199: Utilize threat intelligence to proactively block DNS requests from reaching
malicious domains.

DISCUSSION FROM SOURCE: CMMC
Threat intelligence can provide information on known, bad domain names. Using that
information to prevent access by blocking DNS requests for those domains is one way to
prevent an organization from being attacked with watering hole attacks or malicious
downloads.

CMMC CLARIFICATION
As part of collecting threat intelligence from a variety of sources such as government,
industry peer organizations, or commercial services, use the known, bad domain names to
feed security mechanisms (e.g., DNS servers or firewalls). Implement checks in the
organization’s system to ensure devices making DNS calls to malicious sites are blocked from
getting to those sites. This practice explicitly requires the use of threat intelligence in its
application. This differs from the DNS filtering in practice SC.3.192 that allows for other
means of creating the filters.

Example
You are responsible for network security for your organization and participate in the
National Defense Information Sharing and Analysis Center (ND-ISAC) working groups. You
subscribe to automated feeds from ND-ISAC and electronic sharing with your peers to learn
about new malware sites and update your DNS server to black hole access to them.

References
• CMMC

    • Related Articles

    • CMMC SA.3.169 - Use Cyber Threat Intelligence

      Requirement text: SA.3.169: Receive and respond to cyber threat intelligence from information sharing forums and sources and communicate to stakeholders. DISCUSSION FROM SOURCE: CMMC Establish relationships with external organizations to gather cyber ...

    • CMMC RM.4.150 - Employ Threat Intelligence

      Requirement text: RM.4.150: Employ threat intelligence to inform the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. DISCUSSION FROM SOURCE: ...

    • CMMC SI.4.221 - Use Threat Indicator Information

      Requirement text: SI.4.221: Use threat indicator information relevant to the information and systems being protected and effective mitigations obtained from external organizations to inform intrusion detection and threat hunting. DISCUSSION FROM ...

    • CMMC SA.4.171 - Implement Cyber-Threat Hunting

      Requirement text: SA.4.171: Establish and maintain a cyber-threat hunting capability to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. DISCUSSION FROM SOURCE: DRAFT ...

    • CMMC SC.3.187 - Establish and Manage Cryptographic Keys

      Requirement text: SC.3.187: Establish and manage cryptographic keys for cryptography employed in organizational systems. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Cryptographic key management and establishment can be performed using manual ...