DNS, DHCP & IP Address Management appliances
For Microsoft DNS & DHCP servers
For open source DNS & DHCP servers
Cloud-based visualization of analytics across DDI architecture
Manage multi-vendor cloud DNS servers centrally
RIR Declaration Management and Automation
Automated network device configuration and management
Centralized visibility over all your clouds
A single source of truth for your network automation
Why DDI is an Obvious Starting Point
DNS Threat Intelligence for proactive defense
Intelligence Insights for Threat Detection and Investigation
Adaptive DNS security for service continuity and data protection
Improve Application Access Control to prevent spread of attacks
Protect users and block DNS-based malware activity
Carrier-grade DNS DDoS attack protection
Optimize application delivery performance from the edge
for Proactive Network Security
Visibility, analytics and micro segmentation for effective Zero Trust strategy
Enable work from anywhere by controlling access, security and data privacy
Simplify management and control costs across AWS, Azure and GCP environments
Risk-free migration to reduce DDI complexity and cost
Move risk-free to improve performance, security and costs
Automate management, unify control and strengthen security of connected devices
Protect your network against all DNS attacks, data exfiltration and ransomware
Enable zero touch operations for network management and security
Improve resiliency, deployment velocity and user experience for SD-WAN projects
Integrated DNS, DHCP, IPAM services to simplify, automate and secure your network.
Simplify design, deployment and management of critical DDI services for telcos
Optimize administration and security of critical DDI services for healthcare
Simplify and automate management of critical DDI services for finance
Simplify and automate management of critical DDI services for higher education
Simplify and automate management of critical DDI services for retail
Simplify Management and Automation for Network Operations Teams
Elevate SecOps Efficiency by Simplifying Threat Response
Open architecture for DDI integration
Technology partnerships for network security & management ecosystems
Extend security perimeters and strengthen network defenses
Submit requests for temporary licenses
Submit access requests for EfficientIP knowledge platforms
Submit membership requests for EfficientIP Community
Strengthen Your Network Protection with Smart DNS Security
Customer-centric DDI project delivery and training
Acquire the skills needed to manage EfficientIP SOLIDserverâ„¢
Identify vulnerabilities with an assessment of your DNS traffic
Test your protection against data breaches via DNS
Dedicated representation for your organization inside EfficientIP
Explore content which helps manage and automate your network and cloud operations
Read content which strengthens protection of your network, apps, users and data
Learn how to enhance your app delivery performance to improve resilience and UX
Why Using DNS Allow Lists is a No-Brainer
This enterprise-grade cloud platform allows you to improve visibility, enhance operational efficiency, and optimize network performance effortlessly.
Who we are and what we do
Meet the team of leaders guiding our global growth
Technology partnerships for network security and management ecosystems
Discover the benefits of the SmartPartner global channel program
Become a part of the innovation
The latest updates, release information, and global events
December 19, 2019 | Written by: Efficient IP | DDI, DNS, DNS Security, IPAM, Virtualization & Cloud
APIBusiness ContinuityCommand and ControlComplianceData TheftDDIDDI ManagementDDI ServicesDDI SolutionsDDoS attackDNSDNS FilteringDNS ManagementDNS ProtectionDNS SecurityDNS SolutionDNS Threat IntelligenceDNSSECEnterprise Network SecurityGDPRGlobal DNSIoTIP Address ManagementIPAMIPAM RepositoryMalwareNetwork AutomationNISNIS 2PhishingRansomwareThreat IntelligenceThreat ReportZero Trust
For organizations globally, across all industries, cybersecurity was once more one of the hottest topics of the year. The SonicWall report states that in just the first nine months 7.2 billion malware attacks were launched, with IoT malware worryingly increasing by 33% to 25 million. As the frequency of attacks continued to increase, DNS remained a favorite target, as well as an attack vector (91% of malware are using DNS).
The IDC 2019 Global DNS Threat Report revealed 82% of organizations were victims of DNS attacks, with 63% of the attacks causing app downtime, and the average damage cost per attack increasing 49% to almost $1.1M. This is hardly surprising considering the critical role of DNS to businesses for enabling users to access their important apps and services.
But what’s even more worrying than the number of attacks against DNS is the rise in diversity, sophistication and overall intelligence of the threats, being driven by tools such as DGAs (Domain Generation Algorithms). With the end of 2019 approaching, let’s reflect on the major types of attacks the cybercriminals used and their consequences. Happily, it’s not all doom and gloom, we’ve tried to include some ideas we hope will improve protection of your network.
DNS is not just a technical service running on recursive and authoritative servers in cloud and the internet. It’s also a naming system where authority is key for the system to be organized and coherent. Domains are managed by specific entities called registrars, they are the guardians of the temple. But if information on domain at the registrar level is corrupted or changed by malicious activity, the whole DNS system falls down.
In 2019 we’ve seen a lot of stories about domains being pirated due to badly protected registrar accounts or sophisticated phishing attack to recover credentials. At the beginning of the year numerous organizations were targeted by such attacks, like the Syrian mobile telecommunications provider Syriatel and a Microsoft Outlook Web access portal for the government of Cyprus. These acts usually lead to subdomains created for hosting phishing websites, digital certificate creation using the name of the attacked company and, as a consequence, company reputation being impacted.
Domain information must be protected and responsibility for it given to only very few people in the organization. Their access credential on the registrar portal should be as secure as possible with filtering, screening, one-time passwords and any security system that prevents malicious access.
In addition to reinforcing security on the registrar administration site and limiting access, another good way to prevent hijacking is to implement purpose-built DNS security, in particular making use of DNSSEC (see What is DNSSEC). This will greatly limit the impact on domain manipulation (see Worried About DNS Hijacking? DNSSEC Can Help).
Ransomware encrypts files or entire disks in order to extort a ransom for their safe return. It’s power comes from continual evolution of evasion methods used, meaning that a static analysis technique used today to stop a particular strain of ransomware will be helpless against it’s evolved counterpart tomorrow. Recent examples of ransomware include Ryuk, BitPaymer, MegaCortex, Dharma, SamSam, GandCrab, Matrix and LockerGoga, with the three most common distribution mechanisms used being: 1) Cryptoworms e.g. WannCry 2) Automated Active Adversary 3) Ransomware-as-a-service (RaaS) e.g. Sodinokibi, responsible for several attacks this year.
During the first 9 months of 2019, 151.9 million ransomware attacks occurred (SonicWall report). Government, utilities, healthcare and transportation industries in particular continued to be targeted. Example organizations attacked included Mexico Pemex Oil in November with $4.9M demanded, October attack on Johannesburg causing it to shut down all computers city-wide, September attack on several hospitals in Taipei, and a coordinated ransomware attack on 23 local governments in Texas in August.
For stopping ransomware, basic measures such as patching against vulnerabilities and having backup strategy/files are mandatory, but more advanced solutions involving DNS traffic inspection will also help strengthen defenses.
Enhance your threat visibility by using real DNS transaction inspection to detect stealth attacks, prevent data theft and ensure compliance with regulation like GDPR. Advanced reputation filtering can also be added to your internal DNS solution in order to stay protected against known vulnerabilities using C&C servers behind FQDN.
This year we’ve seen a real evolution of the strategy deployed by malware to infest a network, a server or a workstation. Malware like BuleHero is interesting in the way it uses a large set of vulnerabilities to try entering web servers. When installed on a compromised server it will deploy a spreading strategy to propagate itself to other servers within the network and on the internet. Basic network discovery methods are used for this propagation (e.g. neighbor finding, port scan, vulnerable service scan like RDP, password discovery).
August, September and October saw heightened activity of BuleHero for cryptocurrency-mining campaigns, using up valuable computing resources and slowing down networks and systems. During these campaigns, organizations in telecommunications, IT services, healthcare, banking and transportation were affected.
Some of the command and control servers used by this malware can be inserted in the filtered DNS entries in order to limit its impact (eg ox[.]mygoodluck[.]best). DNS Filtering is used to check that requests to visit websites and automatic background updates with online content comply with web browsing policies. The filtering occurs when the DNS server answers an IP address for the URL to visit, by comparing the website FQDN against its database and configuration. The user is then either allowed to access the website or not. Advanced DNS filtering services go beyond standard protection against known malicious domains, by blocking malware, phishing websites, spyware, adware, browser hijacking software and ransomware. Businesses can also use domain category filters to control access to further categories of content, or to specific websites.
Enterprises who plan to protect their assets with a layer of DNS filtering need to have a threat intelligence solution providing a feed of domains to block, as well as a really powerful engine able to take the appropriate action whenever such domain is requested by a server, a workstation or an IoT device. Common actions available through a DNS firewall product should include: redirection to a specific web page, answering a loopback address, redirecting to a honeypot and also pushing the event towards a SIEM solution.
Cloud providers should be given credit for the level of security they’ve built into their infrastructures. However, businesses are still liable for securing everything on top of the infrastructure, and to ensure they have a backup plan in case of cloud failure. They also need to eliminate configuration errors – normally caused by human errors – which can provide adversaries with an easy way in.
2019 saw many cases of disrupted service continuity for DNS used by cloud providers. Remember the Office365 service outage at Microsoft generated by the supplier’s bad DNS configuration that impacted the authentication service of Azure? More recently, the Route53 DNS services of AWS were unreachable probably due to a massive DDoS attack, bringing down important services used by most applications like S3 object storage.
Cloud services are pretty good, but DNS is so central to any organization that the service really should be split across multiple redundant providers. And what better than having part of it under your own control? Hybrid Cloud DNS infrastructure is available for this precise reason, taking advantage of both worlds: 1) Internal management, audit, supervision and automation. 2) Cloud providers for running the service with a high level of network performance and service visibility.
Most traffic first goes through a DNS resolution, giving it unique visibility over network activity, both legitimate as well as malicious. Businesses have started to recognize this, so are beginning to leverage DNS for their security strategy via threat intelligence, policy control and automation. Once you can link DNS records with IPAM information about IP addresses, networks and devices, as well as with business and functional metadata, you can take advanced automated actions on all control and enforcement points of your IT system. Undoubtedly, DNS is rapidly becoming the guardian of networks!
Here’s a summary of EfficientIP’s top 5 recommendations for protecting DNS services:
When our goal is to help companies face the challenges of modern infrastructures and digital transformation, actions speak louder than words.
Explore content highlighting the value EfficientIP solutions bring to your network
We use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site.