The impact of the post-2020 pandemic has forever changed the world of enterprise security. Remote working, cloud-based technologies, and IoT concepts have changed the security structures of almost all enterprises. With the rise of these concepts, Chief Information Security Officers (CISOs), whose job involves minimising the risk of cyberattacks that could threaten a business, had to deal with completely different environments than those they were familiar with and trained in. These changes meant that many long-standing security tools (such as firewalls, proxy servers, VPNs, and SIEMs) were much less effective and security administrators had to find new tools to address cyber security threats.
In any enterprise network, regardless of its size, there are printers, hard drives, time services, authorisation and validation services, and software repositories, among others. Therefore, it is necessary to allocate shared resources such as Server Message Block (SMB) and Common Internet File System (CIFS) protocols, which are used for these purposes in Windows-based operating systems. These protocols are further developments of the NetBIOS and NetBEUI protocols, which were developed in the mid-1980s by IBM and Microsoft for use in local area networks.
c
Why DNS security?
Since the DNS is an essential part of the Internet, it will always be a target for attackers. The best way to protect against these future attacks is to know the techniques used in the attacks and to identify potential entry points in advance, i.e. threat hunting.
DNS monitoring is an area where enterprise cybersecurity administrators are under-resourced. By leveraging the DNS protocols that enterprises already use, almost every user and machine interaction can be monitored, analysed and, if necessary, protected from attacks ahead in time.
DNS does not care if the data flow is routed on-premises, to devices, to the cloud, to a site, or between different remote sites. In short, DNS monitoring can provide much more security than many CISOs think.
If an attacker takes control of the organisation’s DNS, they can easily:
1. Gain control over open sources,
2. Redirect incoming emails, web requests and authentication attempts,
3. Create and validate SSL/TLS certificates.
DNS security is viewed from two perspectives:
• Continuous monitoring and control of DNS,
• How new DNS protocols such as DNSSEC, DOH, and DoT can help protect the integrity and confidentiality of forwarded DNS requests.
Some organisations use multiple DNS architectures from different sources. This undermines the centralised security that a meticulously used DNS can provide.
However, organisations need visibility into who has access to what, when, and how.
How can you improve your organisation’s security by using DNS, DHCP, and IPAM for threat prevention and security measures?
Although the average enterprise internet traffic is secure, sometimes you find that too many queries are made from one machine. Most of these new data flow connections are not detected at first. As a result, attackers have a field day disrupting as many attacks as possible before enterprise CISOs adapt their defense strategy to the new environment. This is where DNS, DHCP and IPAM analytics can make a big difference.
About 91 percent of malware relies on DNS as a control plane. Phishing attacks, the starting points of other attacks, especially ransomware, can originate from an email or text but not do much damage until they hit DNS. Even DDoS attacks start at the DNS level. DNS is the ideal data source for anomaly-based (zero-day) threat detection using machine learning and other forms of artificial intelligence. A properly managed and monitored DNS maximises security defenses against global threats.
Without DHCP data, it is difficult to correlate different events related to the same verified device, especially in dynamic environments. Without DNS and DHCP, operation teams have a hard time accurately identifying compromised machines and have limited visibility into the resources the user is accessing.
There are many types of attacks that are written specifically to use DNS and explicitly bypass Threat Intelligence defenses. These attacks can only be blocked by a thorough analysis of DNS data. After the rise of clouds and websites, the biggest change in the security environment has been attacks on IoT systems. DNS is a common denominator of IP-connected IoT networks. This means that profiling based on DNS activity can provide early warnings of IoT-induced security breaches.
Conclusion
DNS security should be an integral part of the security plan. DNSDome server services provide web protection and parental control by filtering and blocking unsafe, malicious, and unwanted websites.
DNSSense’s DNSEye solution examines the institution’s DNS server logs and brings potentially malicious traffic under control by routing it through the Intelligence Service filter.
DNSSense’s DNSDome is an effective/advanced cloud-based cybersecurity service that provides web security and application control by analysing users’ DNS traffic. Thanks to its advanced and flexible reporting feature, it provides a true DNS protection layer by providing network administrators with meaningful information so they can take the necessary actions.
