question on minimal file permissions

[hostmaster at g-net.be]

Hi all , 

I'm running bind 9.7 on Ubuntu server 10.04LTS , and I was wondering if
there is documentation on minimal file permissions needed for
bind-config files/zone files. 

The reason I ask is because I'm setting up a DNS sec server and for easy
key rollover and manageability I have created several new directories on
a usb stick for example. Key files and zone files now all have 774
permissions , owned by bind:bind , but I was wondering from a security
point of view if this is correct ? ( I'm running apparmor as well , but
that's only an additional security layer )