How to protect data and infrastructure with DNS security

Network security is top-of-mind across government IT, yet one vulnerability is often overlooked: the domain name system. The DNS is a critical component in networking infrastructure, necessary for every device connected to the Internet because it supplies a directory service for network resources. It is essentially the dial tone of a network, working behind the scenes to provide a pathway that allows information in and out. If the DNS is down, the network cannot function.

And yet it can be a gaping hole in an agency’s cybersecurity defenses. Because the DNS functions as a gateway, it is inherently open and difficult to protect. When it was introduced nearly 30 years ago, it wasn’t designed with security in mind because no one considered it a potential attack vector. Today, many agencies aren’t aware that the DNS is something that needs to be protected, although they should be: DNS data breaches are common and on the rise.

In 2013, the National Institute of Standards and Technology first recognized that the DNS was the next top attack vector in its Secure Domain Name System Deployment Guide: “As hosts become more security aware, and applications begin to rely on the DNS infrastructure for network operations, the DNS infrastructure will become a more tempting target.”

NIST’s predictions were correct: DNS is now the No. 1 protocol used for reflection/amplification attack, and it is tied for first place as the most targeted service for application-layer attacks. Furthermore, data exfiltration via the DNS is also on the rise. If a domain name server is left unprotected, attackers may use it to their advantage to disrupt agency operations.

There are two main types of DNS attacks. The first are DNS distributed denial of service attacks, which limit access to a specific machine or network but can cost organizations an average of $100,000 an hour and take a network totally offline. The second type is data exfiltration, where attackers use the DNS as a way to steal valuable data, including intellectual property, personally identifiable information, emails, classified files and other important data. Both of these attacks have the potential to cripple an agency’s operations.

What are the solutions to securing DNS?

A DNS is simply too valuable to be vulnerable. NIST indicates the primary security goals for a DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and data’s integrity in transit. What does that mean when it comes to actionable goals to protect against DNS attacks?

Before an attack happens:

Be proactive. Get out ahead of the next attack by actively protecting DNS packets. Know that most security protocols aren’t equipped to deal with DNS security. Ideally DNS protection should be built into the DNS server itself, rather than bolted on to other security technologies.  

Ensure network visibility. Knowing what devices are connected to the network and who is using them is essential to identifying and stopping a DNS attack. This information allows IT teams to proactively control and mitigate risks to networks from a myriad of devices, without requiring endpoint software. Consider real-time streaming and analytics to identify threats based on behavioral analysis to detect both zero-day and known threats.

Protect against all types of threats. DNS security should protect against both external and internal threats by blocking attacks on the DNS infrastructure, disrupting malware or advanced persistent threat communications and stopping data exfiltration via the DNS.

After a threat is detected:

Respond quickly. Agencies that have visibility into their networks should be able to quickly find and respond to the threat. IT managers should also have a detailed view of attacks and attempted malicious communications, with drill-down analytics, enabling them to quickly spot and take action to protect their networks.

Keep the network up and running. Services and applications must keep running, even when the network is under attack. Ensure that DNS protection tools allow legitimate traffic through while thwarting illegitimate activity.

Always:

Break down silos. Commonly, agencies use several network security solutions for different types of threats. These tools often don’t work together,  provide poor ROI and limit the effectiveness of the security. Look for DNS solutions that are compatible with the overall security architecture.

Every month it seems cyber attackers find new ways to infiltrate networks, with DNS being one of the most recent targets. Today’s complex threat environment requires an integrated approach, essentially a “defense in depth” cyber strategy in which different security measures work together to protect against a variety of different attack vectors, including ones agencies might not have considered – such as those targeting DNS.