DNS: A Security Differentiator for System Integrators

At BlueCat’s first annual System Integrator Summit, companies in the Federal system integrator and partner community met to learn more about the strong…

At BlueCat’s first annual System Integrator Summit, companies in the Federal system integrator and partner community met to learn more about the strong value of DNS security in government customers and contracts.

Cyber security is one of the few things that everyone in Washington can agree on; so a client-facing DNS security system offers an intriguing value proposition for integrators looking to differentiate their offering – an increasingly vexing problem as Federal IT contracts grow in size and scope.

Federal cyber security resources are usually concentrated on the network perimeter. For most forms of cyber defense, this approach makes sense. By preventing intrusions at the boundary, agencies can protect the valuable information that lies within. The EINSTEIN program, run by DHS as a basic security filter for all Federal networks, is a prime example of this tactic.

Yet when it comes to DNS, there is a better way. When placed on the network perimeter, DNS filters and firewalls have limited value. Since most internet traffic is resolved locally through caches on recursive servers, a perimeter-based DNS security system will only capture a fraction of malicious activity. That recursive layer also obscures the source of DNS traffic, making it difficult to link activity to a specific client.

Only client-facing DNS security systems capture 100 percent of query traffic and attribute it to its source. Since Snowden, Wikileaks, and other insiders, Federal security officials and forensic investigators are increasingly aware of the need to definitively link malicious activity to users. Client-facing DNS security systems provide this capability. For Federal system integrators, that is a key differentiator.

At the BlueCat summit, we heard from a former DOD Assistant Secretary, Rear Admiral Tom Atkin, about stronger policy for effective (and unique) forms of cyber security. With increased pressure to secure networks and data, system integrators face new operational requirements to offer innovative security solutions.

As a core network service, DNS is often overlooked as a potential security asset. In the search for new ways to bring cyber security solutions to Federal customers, system integrators should consider the role of DNS as a defender of networks.


Critical conversations on critical infrastructure

Find out how your peers are managing their networks through profound change. Watch this series of live interactive discussions with IT pros & join the debate in Slack.

Join the conversation

Read more

Customer situation brief on SUNBURST/Solorigate

Learn more about the attack via the SolarWinds Orion platform and how BlueCat products use DNS to help protect customers against compromises like it.

Read more
On the road to platform hardening, consider a STIG

Security Technical Implementation Guides standardize security configuration on networks, servers, and devices. BlueCat uses them and you can, too.

Read more
Network admins’ top 10 checklist for holiday prep

From syncing NTP to having readily accessible DNS maps, here are 10 things you can do to keep your networks reliable during the holiday lull.

Read more
Temporary workaround for SAD DNS

Ahead of Linux’s patch taking effect, BlueCat Labs has a temporary workaround for protecting against the revived Kaminsky DNS cache poisoning attack.

Read more