Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3 DNS Risk Reduction Strategies

Department of Homeland Security cybersecurity guidance identifies the three most common risks associated with the Internet's address infrastructure and provides methods for mitigating them.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The Department of Homeland Security (DHS) has released new cybersecurity guidance for how to thwart attacks on the Internet's domain name system (DNS), a common target of attack for hackers.

The report--based on collaboration with private-sector companies that provide DNS services and prepared with the Information Technology Sector Coordinating Council (IT SCC)--identifies the three most common risks associated with the Internet's address infrastructure and provides methods for mitigating them.

The report is not only aimed at helping protect the Internet from attacks, but also at "ensuring that our cyber networks can bounce back quickly if an attack or disaster does strike," according to a post about the report on the DHS blog.

The report is based on a risk-based assessment done in August 2009, after which the DHS and ITSCC worked with a number of private-sector partners to compile information for the report. The DHS collaborates often with the private sector on cybersecurity matters.

The report is aimed at a number of Internet stakeholders, including Internet standards organizations; government agencies that are large-scale users of DNS; companies that are involved in operating DNS services or providing Internet security services; and government and private organizations that develop and establish Internet governing policies.

The DNS infrastructure is a core aspect of the Internet that translates an Internet protocol address into the email address or URL that people use to access it online. Hackers targeting the DNS can conduct a denial of service (DoS) attack that completely blocks access to a website, which can result in financial losses--especially for companies like banks and payment gateways that are often the target.

A large-scale DoS attack in fact is one of three main risks identified by the DHS in the report, and for which it provides mitigation strategies. The others are information disclosure and loss of privacy and policy failure leading to the breakdown of a single, interoperable Internet.

Across the board, the report recommends conducting education and training and adopting standards to help mitigate all three risks, and also provides advice for how to manage each one in turn.

To address the risk of a DoS attack, the report advises performing a gap analysis to identify the major infrastructure entities that need to coordinate in the event of an attack, as well as adopting standards and best practices for the security of networks.

The DHS also recommends the development of a DNS dashboard to provide global real-time monitoring not only of the holistic health of the DNS, but also to assess health from a user perspective.

To mitigate DNS risks associated with information disclosure and privacy issues, the DHS advises restricting the DNS transaction known as a zone transfer--a method administrators employ for replicating DNS databases across a set of DNS servers--to only known and trusted partners.

The report also recommends that stakeholders implement DNS data and configuration practices, since poor configuration can lead to the disclosure of sensitive information that can be used to stage a cyber attack, according to the report.

The DHS makes the most recommendations in the report for managing the risk of DNS attacks that might hamper the global flow of information on the Internet.

Among them is the implementation of internationalized domain names (IDNs) in the DNS root, a process that has already begun under the management of the Internet Corporation for Assigned Names and Numbers (ICANN), according to the report. ICANN so far has approved 13 country and territory applications in the evaluation phase.

Other recommendations include using global forums to discuss DNS security issues; using the results of internationally supported studies to improve DNS structure; increasing information sharing across the DNS community; and establishing norms of behavior for cyberspace.

What industry can teach government about IT innovation and efficiency. Also in the new, all-digital issue of InformationWeek Government: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.