1.
Role of DNS in
Cyber Security
The Basics – Maps
Name to Numbered
Internet Addresses
Internet: Provides address book for websites,
email servers, social media etc.
Business: Within a business provides internal
address mapping, secure browsing
99% of Cyberspace requires DNS to function
Most Sophisticated & Advanced attacks
require DNS to succeed
Darkweb or Regular Cyberspace – Human
use requires Number to Name Mapping
Address
Book
Basic
Operation
The
Underlying
Plumbing
–
–
Question (query)
Answer
Answer from Authority
Additional Information
Take me to Nominet.uk
OK - Go to 104.20.15.61
–
–
–
–
DNS & Cyber
Resilience
Reliable Indicators
of Attack
User Transparent
Browsing Security
Manage Email Trust
(SPF, DMARC etc.)
Leverage Existing
Technology
Early Threat Intelligence
Identify and Block C2C Callbacks
Tangible Resilience KPIs
Block / Monitor Access to malicious Domains
Organisation Wide & Full Coverage
Use SPF to prevent your email being spoofed
Manage SPF and more
Contact Broadband Provider
Contact Domain Registrar
Internal-to-Your Business DNS
Professional Expertise
–
–
–
–
–
Speed up Browsing Experience
Bank’s website cloned, customers
rerouted, criminals steal credentials -
Actual Bank was NOT hacked
Syrian Electronic Army
compromised DNS rerouted traffic
Using IoT connected cameras
(Mirai botnet) launched a DoS
attack on DYN DNS provider
Copy all scripts, pages of a
website, steal credentials etc
Control DNS, Control All User Content
Redirect Google.com to Fake Website
Redirect email service
& steal credentials
Use DNS to leak sensitive
data avoiding detection
Less common these days
Improperly configured DNS can
reveal information on all assets
2016 Brazilian Bank
2013 New York Times
2016 Large Scale
Denial of Service
Memcache
Clone website and
spread Propaganda
DNS Hijacking
Covert channel to
steal data
Zone Transfer
Some DNS
Hack Examples
Criminal Misuse
of DNS
–
–
–
–
–
–
–
– Hacking DNS
–
–
DNS Mindmap
In association with:
nominet@nominet.uk nominet.uk/cybersecurity +44 (0) 1865 332 255 @Nominet