Skip to main content

🛡️ Google GCE Network DNS Policy Logging is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

Cloud DNS logging records the queries from the name servers within your VPC to Cloud Logging. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.

Rationale​

Security monitoring and forensics cannot depend solely on IP addresses from VPC flow logs, especially when considering the dynamic IP usage of cloud resources, HTTP virtual host routing, and other technology that can obscure the DNS name used by a client from the IP address. Monitoring Cloud DNS logs provides visibility to DNS names requested by clients within the VPC. These logs can be monitored for anomalous domain names and evaluated against threat intelligence.

Note: For full capture of DNS queries, the firewall must block egress UDP/53 (DNS) and TCP/443 (DNS over HTTPS) to prevent clients from using external DNS resolvers.

Impact​

Enabling Cloud DNS logging might result in your project being charged for additional log usage.

Audit​

From Google Cloud CLI​
  1. List all VPC networks in a project:

... see more

Remediation​

Open File

Remediation​

From Google Cloud CLI​

Add New DNS Policy With Logging Enabled​

For each VPC network that needs a DNS policy with logging enabled:

gcloud dns policies create enable-dns-logging \
    --enable-logging \
    --description="Enable DNS Logging" \
    --networks={{vpc-network-name}}

The {{vpc-network-name}} value can include one or more networks in a comma-separated list.

Enable Logging for Existing DNS Policy​

For each VPC network that has an existing DNS policy that needs logging enabled:

gcloud dns policies update {{policy-name}} \
    --enable-logging \
    --networks={{vpc-network-name}}

The {{vpc-network-name}} value can include one or more networks in a comma-separated list.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 2.12 Ensure that Cloud DNS logging is enabled for all VPC networks - Level 1 (Automated _ Roadmapped)1no data
💼 CIS GCP v1.3.0 → 💼 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks - Level 1 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks - Level 1 (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration77no data
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62040no data
💼 FedRAMP High Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)119no data
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)240no data
💼 FedRAMP Moderate Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)119no data
💼 ISO/IEC 27001:2022 → 💼 5.25 Assessment and decision on information security events13no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1824no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1633no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1824no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities50no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources65no data
💼 NIST CSF v2.0 → 💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident17no data
💼 NIST CSF v2.0 → 💼 RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved18no data
💼 NIST CSF v2.0 → 💼 RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved18no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated25no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6 Audit Record Review, Analysis, and Reporting10121no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-7 Audit Record Reduction and Report Generation2119no data
💼 PCI DSS v3.2.1 → 💼 10.6.1 Review security events and critical system component logs at least daily.2no data
💼 PCI DSS v3.2.1 → 💼 10.6.2 Review logs of all other system components periodically based on the organization's policies and risk management strategy, as determined by the organization's annual risk assessment.9no data
💼 PCI DSS v3.2.1 → 💼 10.6.3 Follow up exceptions and anomalies identified during the review process.2no data
💼 PCI DSS v4.0.1 → 💼 10.4.1 The audit logs are reviewed at least once daily.12no data
💼 PCI DSS v4.0.1 → 💼 10.4.1.1 Automated mechanisms are used to perform audit log reviews.2no data
💼 PCI DSS v4.0.1 → 💼 10.4.2 Logs of all other system components are reviewed periodically.19no data
💼 PCI DSS v4.0.1 → 💼 10.4.2.1 The frequency of periodic log reviews for all other system components is defined in the entity's targeted risk analysis.2no data
💼 PCI DSS v4.0.1 → 💼 10.4.3 Exceptions and anomalies identified during the review process are addressed.2no data
💼 PCI DSS v4.0 → 💼 10.4.1 The audit logs are reviewed at least once daily.12no data
💼 PCI DSS v4.0 → 💼 10.4.1.1 Automated mechanisms are used to perform audit log reviews.2no data
💼 PCI DSS v4.0 → 💼 10.4.2 Logs of all other system components are reviewed periodically.19no data
💼 PCI DSS v4.0 → 💼 10.4.2.1 The frequency of periodic log reviews for all other system components is defined in the entity's targeted risk analysis.2no data
💼 PCI DSS v4.0 → 💼 10.4.3 Exceptions and anomalies identified during the review process are addressed.2no data
💼 SOC 2 → 💼 CC4.1-1 Considers a Mix of Ongoing and Separate Evaluations2no data
💼 SOC 2 → 💼 CC4.1-2 Considers Rate of Change2no data
💼 SOC 2 → 💼 CC4.1-3 Establishes Baseline Understanding2no data
💼 SOC 2 → 💼 CC4.1-4 Uses Knowledgeable Personnel2no data
💼 SOC 2 → 💼 CC4.1-5 Integrates With Business Processes2no data
💼 SOC 2 → 💼 CC4.1-6 Adjusts Scope and Frequency2no data
💼 SOC 2 → 💼 CC4.1-7 Objectively Evaluates2no data
💼 SOC 2 → 💼 CC4.1-8 Considers Different Types of Ongoing and Separate Evaluations2no data
💼 SOC 2 → 💼 CC7.3-1 Responds to Security Incidents2no data
💼 SOC 2 → 💼 CC7.3-2 Communicates and Reviews Detected Security Events2no data
💼 SOC 2 → 💼 CC7.3-3 Develops and Implements Procedures to Analyze Security Incidents2no data
💼 SOC 2 → 💼 CC7.3-4 Assesses the Impact on Confidential Information2no data
💼 SOC 2 → 💼 CC7.3-5 Determines Confidential Information Used or Disclosed2no data