2021 IDC Global DNS Threat Report Release: Threat Actors Diversify Toolkits Throughout Pandemic

Almost 90% of organizations have experienced a DNS attack, a rise from last year according to 2021 Global DNS Threat Report

Vulnerabilities from remote working and cloud usage have led to rapid increase in phishing, DNS domain hijacking and cloud instance misconfiguration abuse

EfficientIP, a leading provider of network security and automation solutions specializing in DDI (DNS-DHCP-IPAM), has announced the results of its 2021 Global DNS Threat Report. The annual sponsored research, which was conducted by leading market intelligence firm International Data Corporation (IDC), sheds light on the frequency of the different types of DNS attack and the associated costs for the last year throughout the COVID-19 pandemic.

Nearly 90% of organizations (87%) experienced DNS attacks, with the average cost of each attack around $950,000. The Report shows that organizations across all industries suffered an average 7.6 attacks this past year. These figures illustrate the pivotal role of DNS for network security, both as a threat vector and security objective.

In terms of regional damage from DNS attacks, North America continued to have the highest average cost of attack at $1,031,210. This is a modest decrease by about 4% from the year prior. Countries which saw significant increase in damages included Malaysia which increased by 78%, the sharpest increase, as well as India, Spain and France also seeing significant increases of 32%, 36% and 25%, respectively. Notably, damages in the U.K. declined by 27%.

The report has found that, throughout the past year during the pandemic, attackers have increasingly targeted the cloud, profiting from the reliance on off-premise working and cloud infrastructures. Around a quarter of companies have suffered a DNS attack abusing cloud misconfiguration, with almost half of companies (47%) suffering cloud service downtime as a result of DNS attacks.

The Threat Report, now in its seventh year, also found a sharp rise in data theft via DNS, with 26% of organizations reporting sensitive customer information stolen compared to 16% in 2020’s Threat Report.

Evidence shows attackers are targeting more organizations and diversifying their toolkit—sometimes drastically. Threat actors relied on domain hijacking, where the user is connected not to the desired service but to a fake one, more than twice as often as last year. This year phishing also continued to grow in popularity (49% of companies experienced phishing attempts), as did malware-based attacks (38%), and traditional DDoS attacks (29%).

Although the cost and variety of attacks remains high, there is a growing awareness of DNS security and how to combat these attacks. 76% of respondents in the 2021 Threat Report deemed DNS security a critical component of their network architecture. Additionally, the report found Zero Trust is evolving as a tool to protect networks in the remote era. 75% of companies are planning, implementing or running Zero Trust initiatives and 43% of companies believe DNS domain deny and allow lists are highly valuable for Zero Trust for improving control over access to apps.

The DNS Threat Report finds solutions considered most effective by organizations for preventing theft includes: securing network endpoints (31%) and better monitoring threat and analysis of DNS traffic (26%).

“While it is positive that companies want to use DNS to protect their increasingly remote workforces, organizations are continuing to suffer the costly impacts of DNS attacks,” says Romain Fouchereau, Research Manager European Security at IDC. “As threat actors seek to diversify their toolkits, businesses must continue to be aware of the variety of threats posed, ensuring DNS security is a key priority to preventing these.”

DNS offers valuable information against would-be cybercriminals that is currently underutilized. According to results from the 2021 Threat Report, 25% of companies perform no analytics on their DNS traffic.

“This past year of the pandemic has shown us that DNS must play a role in an effective security system.” says Ronan David, VP of Strategy for EfficientIP. “As workers look to more permanently transition to off-premise sites, making use of cloud, IoT, edge and 5G, companies and telecom providers should look to DNS for a proactive security strategy. This will ensure the prevention of network or application downtime as well as protecting organizations from confidential data theft and financial losses.”

The report suggests three recommendations for protecting data, apps, cloud services and users, including enhancing the privacy of remote workers with a private DoH solution, eliminating cloud service downtime caused by cloud misconfigurations through automating life-cycle management of IP resource and making DNS the first line of defense to stop the spread of attacks. The full 2021 Global DNS Threat Report is available here: https://efficientip.com/resources/reports-surveys-2/idc-dns-threat-report-2021/

NOTE TO EDITORS
ABOUT THE 2021 DNS THREAT REPORT
The research was conducted by IDC from January to March 2021. The data collected represents respondents’ experience for the previous year. The results are based on 1,114 respondents from companies with 500 or more employees. Respondents came from three regions – North America, Europe and Asia Pacific. Respondents included CISOs, CIOs, CTOs, IT Managers, Security Managers and Network Managers.