Why securing the DNS layer is crucial to fight cyber crime

Major consequences 

When left insecure, DNS servers can result in devastating consequences for businesses that fall victim to attack. Terry Bishop, solutions architect at RiskIQ, says: “Malicious actors are constantly looking to exploit weak links in target organisations. A vulnerable DNS server would certainly be considered a high-value target, given the variety of directions that could be taken once compromised.

“At RiskIQ, we find most organisations are unaware of about 30% of their external-facing assets. That can be websites, mail servers, remote gateways, and so on. If any of these systems are left unpatched, unmonitored or unmanaged, it presents an opportunity for compromise and further potential exploit, whether that is towards company assets, or other more valuable infrastructure such as DNS servers are dependent on the motives of the attacker and the specifics of the breached environment.”

Kevin Curran, senior member at the Institute of Electrical and Electronics Engineers (IEEE) and professor of cyber security at Ulster University, agrees that DNS attacks can be highly disruptive. In fact, an improperly working DNS layer would effectively break the internet, he says.

“If the domain name system was to fail, all the website names that people type would also fail to be converted to their proper IP address equivalent – which is the only way the internet can actually route our requests – and we would not have a functioning internet,” says Curran. “Of course, if people knew the hard-to-remember IP address of a site, they could type that instead, but that is not a realistic scenario.”

However, there are different protocols that can help to mitigate DNS security risks, he says. “The two major updates to DNS have been DNS over TLS [DoT] and DNS over HTTPS [DoH]. These two standards encrypt plaintext DNS traffic to prevent malicious parties, advertisers, ISPs, etc from intercepting the data.”

Curran adds: “DoT uses the same security protocol that HTTPS websites use to encrypt and authenticate. It adds TLS encryption over the user datagram protocol [UDP], thus ensuring that DNS requests and responses are not modified or forged through on-path attacks. DoH again uses encryption, but DNS messages are sent using the HTTP or HTTP/2 protocols. DoH traffic resembles normal HTTPS traffic if examined with a packet analyser.”

Curran says there is debate about the best method, however. “Some argue that DoT is better from a network security standpoint as network admins can monitor and block DNS queries, such as malicious traffic,” he says. “DoH queries, however, are concealed in regular HTTPS traffic, so they cannot be blocked as easily without blocking other HTTPS traffic too. DoH does provide more privacy. However, as DNS queries are hidden within the HTTPS traffic, this is crucial to many.”

Preparing for DNS attacks 

When it comes to identifying and mitigating cyber attacks, the DNS layer offers a great deal of insight. Mark Fieldhouse, Europe, Middle East and Africa (EMEA) general manager at NS1, says: “Integrating DNS with monitoring and reporting systems gives visibility into application and network traffic, so that companies can more easily observe DNS configuration changes and shifting traffic patterns, which will reveal key indicators of compromise. DNS can also provide net fencing to prevent sites from receiving traffic from suspicious countries, regions or domains. 

“Leveraging an always-on, redundant anycast DNS network ensures resilience and minimises the impact of attacks by dynamically routing traffic around compromised resources to prevent downtime. Enabling DNSSEC protects the integrity of DNS records by having them digitally signed and verified, which ensures users are not receiving fake information injected by attackers.”

Fieldhouse says DNS, DHCP and IP address management (DDI) is crucial to a zero-trust approach. “DNS traffic can be routed seamlessly, and blocked, depending on specific criteria, to protect company data from threats,” he says. “DDI solutions integrate with the vast majority of applications that organisations use to function, which ensures uniform control. 

“The external DNS needs just as much protection as the internal network”

“It is also important to note that while zero-trust security guards against internal data breaches, DNS attacks can be just as destructive, so the external DNS needs just as much protection as the internal network.”

Venu Vissamsetty, vice-president of security research at Attivo Networks, recommends a layered defence approach comprising DNS monitoring and filtering, endpoint protection, endpoint data cloaking and access controls. This is particularly useful for tackling ransomware attacks, he says. 

“After the initial infection, ransomware initiates DNS lookups to contact C&C [command and control] and download additional payloads,” says Vissamsetty. “DNS filtering and blocking can potentially stop ransomware attacks at the initial payload stage. Targeted attacks can evade DNS filtering, so it is recommended to have zero-trust data access controls to prevent and minimise the impact of ransomware.”

Applying new techniques to DNS

As digital transformation increases, businesses can use DNS as an effective cyber defence tool, according to Steve Forbes, government cyber security expert at Nominet, who says every communication between a company’s network and the wider world is logged in the DNS traffic.

“This means that if an attacker does gain access, communication between the malware and the command and control centre, for example, is highly likely to be in that DNS traffic,” says Forbes. “With the advancements in AI [artificial intelligence] and machine learning – which can detect patterns in the source, destination and characteristic of network traffic – it has become easier to detect this potentially malicious traffic at a much earlier point than before.

“This gives security teams the time to effectively deal with any attacks by giving early warning indicators, reducing the time to remediate the threat.”

Forbes says that applying new techniques to DNS enables businesses to identify normal behaviour on a network, as well as unusual or suspicious behaviour that could indicate a cyber attack. 

“Companies can use information from their DNS servers to detect new attacks”

“This leads to blocking potentially malicious actors from gaining access and highlighting insider threat, while also reducing the number of false positives and workload for security workers to process,” he says. “Finally, because DNS covers the whole of the company’s network, it scales well and will go on protecting you as digital transformation causes your attack surface area to expand.”

John Graham-Cumming, CTO at Cloudflare, says there are a number of things that businesses can do when it comes to DNS-based security. “Firstly, you need to protect DNS infrastructure from the basic attacks, like DDoS, that can be used against anything on the internet,” he says. “Then you should ensure that, like any other piece of software, the DNS servers are up to date and patched. With these in place, companies can use information from their DNS servers to detect new attacks.

“By feeding corporate DNS log data into an analysis tool, it is possible to spot unusual behaviour, which might indicate malware, from a corporate device. By provisioning the DNS server as something each corporate device uses, it is also possible to control, at the DNS level, what internet resources a user or machine can access, and block well-known malware or phishing.”

DNS security is often overlooked by organisations, but with more and more cyber attacks targeted at businesses, it is an area of great importance. Securing the DNS layer will not only protect it, but will also allow businesses to detect and fight cyber attacks before serious damage is done.