Bonus Question: Are DNS and DHCP services hardened and monitored for abuse or spoofing?

Why This Matters

DNS and DHCP are foundational network services. Compromise or spoofing can redirect traffic, enable exfiltration, or disrupt operations.

Maturity

0 — Unaware
Unsecured DNS/DHCP; no logging or validation.

1 — Ad Hoc
Default configurations; reactive fixes.

2 — Defined
Hardened configuration and basic logging enabled.

3 — Managed
DNSSEC and dynamic update controls implemented.

4 — Integrated
Abuse detection and alerting integrated with SIEM.

5 — Optimized
Threat-intel correlation and anomaly detection automated.

How to Level Up

| From → To | Actions | |—|—| | 0 → 1 |Harden DNS/DHCP servers and enable logging.|
| 1 → 2 |Apply access controls and restrict zone transfers.|
| 2 → 3 |Enable DNSSEC and monitor updates.|
| 3 → 4 |Integrate logs with SIEM for alerting.|
| 4 → 5 |Correlate with threat feeds for spoofing attempts. |

Enablers

People: Network Ops, SOC Analyst
Process: Harden → Monitor → Respond
Technology: DNSSEC, SIEM, Threat intel feeds

Evidence

Server configurations and policies
Log samples showing query validation
Incident reports (if any)

KPIs

Percentage of DNS zones signed with DNSSEC
Average time to detect spoofing attempts
Number of DNS/DHCP incidents per quarter

Low-Cost / Open-Source Options (MSME)

Common Pitfalls

No logging of DNS queries
Zone transfers left open
DHCP used without authorization controls

Compliance Mapping