DNS Security in Six Star Wars Memes

DNS is a chump.  It knows deep down that it shouldn’t connect you with that malicious website.  It wants to tell you that the link you’re clicking actually resolves to Siberia, not Peoria.  But DNS just can’t help it.  It follows orders.  It’s “weak minded” and goes exactly where you tell it to go.

Unfortunately, naïve resolution of DNS queries often leads to severe cybersecurity vulnerabilities.  Cybercriminals know how to exploit DNS to achieve their ends – 91% of all cyberattacks use DNS.  With the power of automation, domain generation algorithms make the realm of DNS-based cyber criminality that much more powerful.  DNS tunneling, while often used for legitimate purposes, is just as often used for the dark side.

Most network administrators don’t see DNS as a potential security weakness – it’s just sitting there, resolving queries in the background.  Yet un-monitored, un-secured DNS can bring an entire network down.  Boundary-level DNS security is a good start, but even that cedes internal DNS queries to malicious actors, allowing them to locate and exfiltrate critical records in ways that boundary-level DNS protections will never identify.  Only a DNS-based security system which touches the entire network will prevent and/or contain security breaches.

DNS-based security brings intelligence to what would otherwise be a naïve system.  Instead of resolving to any domain, DNS-based security asks common sense questions before pushing the query through.  Is this request legitimate?  Is this request going to a blacklisted domain?  Should this single-use IoT device be allowed to connect to critical HR information?  Does the finance server need a connection to SCADA systems?

If the answer to any of these questions triggers an alert or is anomalous in any way, DNS-based security has the power to apply policies which monitor or simply block the query. 

Applying intelligence to DNS queries not only voids the naïve resolution problem, it makes DNS an active participant in cybersecurity.  Since every client and server uses DNS to communicate, applying intelligence to that communication protocol is a big step toward securing the entire network.  Malicious actors rely on the fact that most network administrators take DNS for granted, using it to expand their footprint undetected.  Secured DNS prevents this from happening, cutting off vital exploitation vectors in real time.

BlueCat is pioneering new approaches to DNS-based security.  Our sole focus on DNS means that we know a thing or two about how this vital asset can be used to lock down the network.  We think that our DNS Edge product is pretty special, since it applies all of the intelligence of DNS-based security at the client level.  We invite you to learn more about DNS Edge here.