Threat Actors Have Grown Smarter in Their DNS Attacks. Here’s How Companies Should Respond…

Over the past year–during the COVID-19 pandemic–businesses have accelerated their digital transformation as the pandemic has continued to require off-premise working and online or cloud-based products and services. But digital transformation is not the only area to experience vast change during the pandemic. Our annual report with IDC reveals that attackers have changed their tactics this year, growing more diverse in their methods for abusing the DNS protocol; businesses have had to pivot to smarter methods in order to keep their products and services safe. As a result, DNS security is more vital now than ever before.

A threat landscape that affects everyone

The 2021 DNS Threat Report shows that DNS attacks are expensive and damaging. Nearly 90% of organizations experienced DNS attacks in the past year, with the average cost of each attack around $950,000. The Report shows that organizations across all industries suffered an average 7.6 attacks this past year. These figures illustrate the pivotal role of DNS for network security, both as a threat vector and security objective.

DNS attackers have been active around the world. North America leads in damages, as it did last year, and Asia experienced a sharp rise in damages at 15% higher than last year. The cost per attack is highest as a region in North America ($1,031,210), and the average cost per attack is highest in the United States at $1,051,900. Other countries that saw average damages above $1M were India, France, and Germany.

DNS attacks target every industry, but the COVID-19 pandemic has made some sectors more vulnerable than usual, making it all the more critical for business leaders in these industries to understand where their vulnerabilities lie. For example, healthcare experienced the highest increase in cost per attack compared to last year (12%). The financial services industry suffered the most expensive average cost of attack at $1,078,190, and telecommunications and media as an industry saw the highest number of overall DNS attacks over a 12-month period, with an average of 8.6 attacks.

Business impacts are consequential: data theft, app downtime, cloud service downtime

As well as the financial damages stated above, DNS attacks also had a serious impact on business continuity and brand damage, which can lead to customer churn. Data theft via DNS rose sharply by 10 percentage points, now affecting one in four companies and highlighting the fact that legacy solutions like firewalls struggle to detect data exfiltration via DNS. Application downtime (on premise and/or cloud) as a result of a DNS attack is another area of concern, with 76% of organizations being victims.

Threat actors are diversifying their toolkits

The statistics above show that attackers are relying on a wider variety of methods to target industries. All the attack types contained in the DNS Threat Report survey saw rises compared to last year, and sometimes those rises were dramatic. For example, threat actors relied on domain hijacking, where the user is connected not to the desired service but to a fake one, 125% more often this year compared to last year. Instances of cloud instance misconfiguration abuse also shot up by 77%, likely as a response to how the increased reliance on the cloud in the era of remote work. (According to The Cloud Security Alliance, cloud misconfigurations remain the top cause for data breaches in the cloud.) DNS tunneling and Zero-Day vulnerabilities also increased by a sizable amount (41% and 44%, respectively).

Phishing is still a preferred attack method amongst threat actors, with nearly half of companies experiencing a phishing attack, and Ransomware remains popular at 38%. The diverse attacks available mean that businesses must be better prepared for any number of incoming varied threats.

Remote working has prompted businesses to re-evaluate the value of DNS security in mitigating attacks

This was the first year that the Threat Report added questions particular to remote workers, SD-WAN, SASE and IoT into its survey. The results are telling. 55% of companies see DNS security as critical for protecting a remote workforce, and 51% are considering setting up a Private Enterprise DoH for protecting data privacy of their remote workers.

Zero Trust relies on DNS security for improving application access control

Zero Trust is also evolving as a tool to protect networks in the remote era. 75% of companies are planning, implementing or running Zero Trust initiatives. 78% of companies believe DNS domain deny and allow lists are highly valuable for Zero Trust, for improving control over access to apps, particularly when combined with granular DNS filtering of client queries, down to individual user level. This offers a security barrier as early as possible in the traffic flow, helping limit the spread of attacks across the infrastructure.

Where business can improve their security posture

Despite the increased ways businesses are using DNS to protect their network, they could be doing more. DNS is the first line of defense as it sees the intent of virtually all IP traffic. Use of DNS provides information for automation of security policies and helps power a Security Orchestration, Automation and Response (SOAR) platform, but this asset is being underutilized. Automation is incredibly useful for network security policy management, but currently only 57% of companies surveyed are using mostly automated solutions.

Companies can also get smarter about how they analyze network traffic. As part of their data received, security information and event management (SIEM) platforms can make use of DNS Traffic logs. About 27% of companies in the survey sent their DNS traffic to SIEM for analysis. However, these are normally huge volumes of data, causing inefficiencies and breach fatigue. A smarter option would be for DNS to feed SIEMs and SOCs with only the relevant and actionable data on specific behaviors, translating in greater efficiency as SOCs won’t need to analyze all traffic.

For those who do NOT use SIEM, 71% collect DNS Traffic but analyze it manually. Making use of DNS security event triggers would help simplify analysis and bring significant time savings.

Finally, DNS helps overcome security holes that are often left by firewalls and IPS, particularly when coupled with other security components including Data Loss Prevention (DLP) and Network Access Control (NAC). It is evident that NAC and DNS are extremely complementary tools for maximizing the discovery of compromised devices: NAC performs the static tasks for network access, while DNS performs dynamic functions with filtering for application access.

As threat actors seek to diversify their toolkits, businesses must continue to be aware of the variety of threats posed, ensuring purpose-built DNS security is a key priority to preventing these. Now is the best time to prioritize the security, structure and logistics of your company’s network architecture.