{
  "Provider": "gcp",
  "CheckID": "dns_dnssec_disabled",
  "CheckTitle": "Ensure That DNSSEC Is Enabled for Cloud DNS",
  "CheckType": [],
  "ServiceName": "dns",
  "SubServiceName": "",
  "ResourceIdTemplate": "",
  "Severity": "medium",
  "ResourceType": "DNS_Zone",
  "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
  "Risk": "Attackers can hijack the process of domain/IP lookup and redirect users to malicious web content through DNS hijacking and Man-In-The-Middle (MITM) attacks.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "https://docs.bridgecrew.io/docs/bc_gcp_networking_5#cli-command",
      "NativeIaC": "",
      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudDNS/enable-dns-sec.html",
      "Terraform": "https://docs.bridgecrew.io/docs/bc_gcp_networking_5#terraform"
    },
    "Recommendation": {
      "Text": "Ensure that DNSSEC security feature is enabled for all your Google Cloud DNS managed zones in order to protect your domains against spoofing and cache poisoning attacks. By default, DNSSEC is not enabled for Google Cloud public DNS managed zones. DNSSEC security feature helps mitigate the risk of such attacks by encrypting signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect web clients to fake, fraudulent or scam websites.",
      "Url": "https://cloud.google.com/dns/docs/dnssec-config"
    }
  },
  "Categories": [],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
