RA3103: Block External Domain

Summary

ID	RA3103
Brief Description	Block an external domain name from being accessed by corporate assets
Author	@atc_project
Creation Date	2019/01/31
Requirements	MS_border_proxy MS_border_ips MS_border_ngfw MS_dns_server
References	https://en.wikipedia.org/wiki/DNS_sinkhole
Response Stage	Containment

Description

Block an external domain name from being accessed by corporate assets, using the most efficient way.

Warning:

• Be careful blocking doman names. Make sure it's not a cloud provider or a hoster. If you would like to block something that is hosted on a well-known cloud provider or on a big hoster doman, you should block (if applicable) a specific URL using alternative Response Action