DNS Data: The New Cybersecurity Hero

There is cruel irony in DNS. By their very nature, Domain Name Systems facilitate an internet-friendly naming environment making it simple and seamless for users to access websites, emails and applications.

There is cruel irony in Domain Name System (DNS). By their very nature, Domain Name Systems make it simple and seamless for users to access websites and applications. But this very system is now finding itself to be the ultimate vulnerable point of origination for malicious cyber activity – and an unlikely hero in cyber security.

DNS is the switchboard for all internet requests. Every single client (human or device) connects to every app or service – whether internal or external to the organization – through a DNS request. That request is fulfilled by a series of DNS servers, working diligently to accommodate the DNS query to ultimately get you where you want to go.

Alas, all of this open relaying of requests across servers and DNS resolvers leaves the network exposed to hacking. Bear in mind, DNS was built for connectivity, not security. What’s more, DNS is, in effect, the lowest common denominator for all internet activity. So not only do all legitimate requests originate at the DNS level, so do all malicious activities.

From ransomware to internal bad actors, networks have proven themselves as the perfect gateway for all kinds of cyberattacks. Chances are, someone on your network has unwittingly clicked on a bad link or opened the wrong attachment. That’s how easy it is for malware to penetrate your organization and spread quietly from device to device.

DNS as Cyber Hero

As cybersecurity continues to concern CTOs, IT professionals everywhere add extra layers of defense to their technology stack to keep their organization safe– without success.

It’s a network architecture issue.  Recursive servers sit between client devices and the network boundary.  When filters and firewalls look back into the network, they can only see the last hop server.  The internal DNS servers, internal IP addresses, and devices making DNS queries are essentially invisible.

That lack of visibility might be excusable if the number of internal queries was small.  But it isn’t. The fact that a majority of network queries never even make it to external-facing security sensors exposes a significant weakness in the “set it and forget it” mentality associated with boundary-level security systems.

Consider your helpful DNS, already in place, uniquely positioned to foil unwarranted internet queries at their source. Together with firewalls and other protection strategies, utilizing DNS records has now become part of the modern arsenal in cybersecurity.

Analysing DNS traffic can keep your network safe if you know how to leverage it.

By providing important visibility into network activity, DNS data can inform:

  • Who is on your network
  • Who is trying to access what
  • Aberrations in normal patterns of activity
  • Identified gaps in security

Why is this visibility so vital? Because it equips you with information you can act on.

An analysis of log records often uncovers irregular network activities and enforces policies by blocking questionable DNS clients. Leveraging DNS in this way allows administrators to do more than simply see query logs – it allows them to gauge the intent of queries. With complete information about every query on the network, administrators can root out malicious patterns of behavior, identify patient zero or other infected devices.

Using DNS for security also provides the opportunity to apply security policies to DNS queries. Whether it’s done at the network boundary or at the client level, DNS-based security policies can be very targeted, allowing as much or as little leeway for queries to resolve as appropriate. 

Compromised records cost companies millions of dollars each year, according to this security breach report; loss of reputation notwithstanding. The report also reveals that the average time to identify a breach is 201 days, and the average time to contain it is 70.

Leverage DNS data to reveal the identity and intent of those on your network. You’ll strengthen security and effectively protect your enterprise.

An avatar of the author

Growth by Content is what I do. I’m fuelled by conversations, coffee and sarcasm.

Related content

Detect anomalies and CVE risks with Infrastructure Assurance 8.4 

The Infrastructure Assurance 8.4 release features an anomaly detection engine for outliers and a CVE analysis engine to uncover device vulnerabilities.

Read more

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

Security, automation, cloud integration keys to DDI solution success

Only 40% of enterprises believe they are fully successful with their DDI solution. Learn how to find greater success with new research from EMA and BlueCat.

Read more

Our commitment to Micetro customers and product investment

From CEO Stephen Devito, a word on BlueCat’s ongoing commitment to supporting Micetro customers and Micetro’s evolution as a network management tool.

Read more

Seven reasons to rethink firewall monitoring and boost automation 

With BlueCat Infrastructure Assurance, you can better protect your network with automated alerts and suggested remedies for hidden issues in your firewalls.

Read more