Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3 DNS Risk Reduction Strategies

Department of Homeland Security cybersecurity guidance identifies the three most common risks associated with the Internet's address infrastructure and provides methods for mitigating them.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The Department of Homeland Security (DHS) has released new cybersecurity guidance for how to thwart attacks on the Internet's domain name system (DNS), a common target of attack for hackers.

The report--based on collaboration with private-sector companies that provide DNS services and prepared with the Information Technology Sector Coordinating Council (IT SCC)--identifies the three most common risks associated with the Internet's address infrastructure and provides methods for mitigating them.

The report is not only aimed at helping protect the Internet from attacks, but also at "ensuring that our cyber networks can bounce back quickly if an attack or disaster does strike," according to a post about the report on the DHS blog.

The report is based on a risk-based assessment done in August 2009, after which the DHS and ITSCC worked with a number of private-sector partners to compile information for the report. The DHS collaborates often with the private sector on cybersecurity matters.

The report is aimed at a number of Internet stakeholders, including Internet standards organizations; government agencies that are large-scale users of DNS; companies that are involved in operating DNS services or providing Internet security services; and government and private organizations that develop and establish Internet governing policies.

The DNS infrastructure is a core aspect of the Internet that translates an Internet protocol address into the email address or URL that people use to access it online. Hackers targeting the DNS can conduct a denial of service (DoS) attack that completely blocks access to a website, which can result in financial losses--especially for companies like banks and payment gateways that are often the target.

A large-scale DoS attack in fact is one of three main risks identified by the DHS in the report, and for which it provides mitigation strategies. The others are information disclosure and loss of privacy and policy failure leading to the breakdown of a single, interoperable Internet.

Across the board, the report recommends conducting education and training and adopting standards to help mitigate all three risks, and also provides advice for how to manage each one in turn.

To address the risk of a DoS attack, the report advises performing a gap analysis to identify the major infrastructure entities that need to coordinate in the event of an attack, as well as adopting standards and best practices for the security of networks.

The DHS also recommends the development of a DNS dashboard to provide global real-time monitoring not only of the holistic health of the DNS, but also to assess health from a user perspective.

To mitigate DNS risks associated with information disclosure and privacy issues, the DHS advises restricting the DNS transaction known as a zone transfer--a method administrators employ for replicating DNS databases across a set of DNS servers--to only known and trusted partners.

The report also recommends that stakeholders implement DNS data and configuration practices, since poor configuration can lead to the disclosure of sensitive information that can be used to stage a cyber attack, according to the report.

The DHS makes the most recommendations in the report for managing the risk of DNS attacks that might hamper the global flow of information on the Internet.

Among them is the implementation of internationalized domain names (IDNs) in the DNS root, a process that has already begun under the management of the Internet Corporation for Assigned Names and Numbers (ICANN), according to the report. ICANN so far has approved 13 country and territory applications in the evaluation phase.

Other recommendations include using global forums to discuss DNS security issues; using the results of internationally supported studies to improve DNS structure; increasing information sharing across the DNS community; and establishing norms of behavior for cyberspace.

What industry can teach government about IT innovation and efficiency. Also in the new, all-digital issue of InformationWeek Government: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Chinese Attackers' Favorite Flaws Prove Global Threats, Research Shows
Kelly Sheridan, Staff Editor, Dark Reading,  10/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27742
PUBLISHED: 2020-10-28
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926&qu...
CVE-2020-27980
PUBLISHED: 2020-10-28
Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
CVE-2020-24990
PUBLISHED: 2020-10-28
An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version.
CVE-2020-25204
PUBLISHED: 2020-10-28
The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver. The purpose of this broadcast receiver is to show an in-game push notification to the player. However, the applicatio...
CVE-2020-27739
PUBLISHED: 2020-10-28
A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.