A new model for securing deployments of DNS Edge

At BlueCat, we’ve recently taken steps to become more reliable in our deployment model and more robust in our back-end security practices.

The shared responsibility model for cloud security separates out accountability across customers, stakeholders, and solution providers.  At BlueCat, we take responsibility for our part of cloud security very seriously.  That’s why we’ve recently taken steps to become more reliable in our deployment model and more robust in our back-end security practices.

Security monitoring through IP addresses

Most cloud resources in AWS require the creation of a Virtual Private Cloud (VPC) instance.  (BlueCat uses AWS, but every cloud provider has a similar service.)  Each of these VPCs runs through a set IP address assigned by the user.  As the designated paths of information to and from any VPC, these IP addresses are a significant source of data for both cloud security and performance management. 

By monitoring the DNS data flowing through that IP address, network administrators can learn a lot about how their cloud resources are performing.  Security teams can use the same information to detect anomalies and monitor traffic for indicators of compromise.  If someone left a port open, if malicious code was added to the cloud instance, if VMs are behaving erratically, if a DDOS attack is underway – all of this activity can be detected by triangulating DNS data with other information such as syslogs.

Assuring performance and security

DNS Edge, BlueCat’s SaaS security product, deploys through VPCs (along with other resources) in the AWS cloud.  BlueCat now leverages the IP addresses assigned to those VPCs to ensure optimal performance and strengthen security controls on the operational back-end.

Here’s what we’re doing:  BlueCat has created a series of automated workflows through its Gateway platform to assign IP addresses to VPCs in the cloud.  These workflows are scheduled to run in sequence through Rundeck.  The way these IP addresses are assigned allows BlueCat to monitor individual accounts for security and performance issues through its back-end security tools.

This process also avoids some of the manual set-up steps previously required of users, and ensures a common approach to deployment.  It will also allow customers to set up and deploy DNS Edge service points on their own. 

The path forward

With this deployment model in place, BlueCat is also starting down the path toward multitenancy – the ability to support multiple customers through a single account.  In this phase of the journey, we are enabling the separation of customer accounts, and the ability to audit activity on those accounts. 

These changes will also make information for FedRAMP and SOC compliance easier to obtain.  Both standards require vulnerability scans at critical entry/exit points – by monitoring the IP address assigned to VPCs for DNS Edge, BlueCat will now be able to perform those scans continuously.


An avatar of the author

BlueCat provides core services and solutions that help our customers and their teams deliver change-ready networks. With BlueCat, organizations can build reliable, secure, and agile mission-critical networks that can support transformation initiatives such as cloud adoption and automation. BlueCat’s growing portfolio includes services and solutions for automated and unified DDI management, network security, multicloud management, and network observability and health.

Related content

Micetro_ Hybrid Cloud Integration Blog

Micetro simplifies hybrid cloud DNS and IP address management

Learn how Micetro can help you simplify and streamline DNS and IP address management across hybrid and multicloud environments.

Read more
Three operational reasons to drop legacy tools and unify your DDI

Three operational reasons to drop legacy tools and unify your DDI

Learn with BlueCat how visibility and control, process automation, and infrastructure reliability offer three reasons to adopt Unified DDI.

Read more
Micetro_ Simplify Microsoft DNS_ DHCP_ and Active Directory Sites Management

Simplify Microsoft DNS, DHCP, and Active Directory with Micetro

Learn how Micetro makes it easy to administer Microsoft DNS, DHCP, and Active Directory sites and subnets and manage your DDI environment.

Read more
Get insight into your DDI environment with Live DDI Analytics

Get insight into your DDI environment with Live DDI Analytics

Enroll in our technology preview today to use the Live DDI Analytics tool to get real-time reports and analysis for your DDI environment.

Read more