3 DNS Risk Reduction Strategies

Inside DHS' Classified Cyber-Coordination Headquarters

The Department of Homeland Security (DHS) has released new cybersecurity guidance for how to thwart attacks on the Internet's domain name system (DNS), a common target of attack for hackers.

The report--based on collaboration with private-sector companies that provide DNS services and prepared with the Information Technology Sector Coordinating Council (IT SCC)--identifies the three most common risks associated with the Internet's address infrastructure and provides methods for mitigating them.

The report is not only aimed at helping protect the Internet from attacks, but also at "ensuring that our cyber networks can bounce back quickly if an attack or disaster does strike," according to a post about the report on the DHS blog.

The report is based on a risk-based assessment done in August 2009, after which the DHS and ITSCC worked with a number of private-sector partners to compile information for the report. The DHS collaborates often with the private sector on cybersecurity matters.

The report is aimed at a number of Internet stakeholders, including Internet standards organizations; government agencies that are large-scale users of DNS; companies that are involved in operating DNS services or providing Internet security services; and government and private organizations that develop and establish Internet governing policies.

The DNS infrastructure is a core aspect of the Internet that translates an Internet protocol address into the email address or URL that people use to access it online. Hackers targeting the DNS can conduct a denial of service (DoS) attack that completely blocks access to a website, which can result in financial losses--especially for companies like banks and payment gateways that are often the target.

A large-scale DoS attack in fact is one of three main risks identified by the DHS in the report, and for which it provides mitigation strategies. The others are information disclosure and loss of privacy and policy failure leading to the breakdown of a single, interoperable Internet.

Across the board, the report recommends conducting education and training and adopting standards to help mitigate all three risks, and also provides advice for how to manage each one in turn.

To address the risk of a DoS attack, the report advises performing a gap analysis to identify the major infrastructure entities that need to coordinate in the event of an attack, as well as adopting standards and best practices for the security of networks.

The DHS also recommends the development of a DNS dashboard to provide global real-time monitoring not only of the holistic health of the DNS, but also to assess health from a user perspective.

To mitigate DNS risks associated with information disclosure and privacy issues, the DHS advises restricting the DNS transaction known as a zone transfer--a method administrators employ for replicating DNS databases across a set of DNS servers--to only known and trusted partners.

The report also recommends that stakeholders implement DNS data and configuration practices, since poor configuration can lead to the disclosure of sensitive information that can be used to stage a cyber attack, according to the report.

The DHS makes the most recommendations in the report for managing the risk of DNS attacks that might hamper the global flow of information on the Internet.

Among them is the implementation of internationalized domain names (IDNs) in the DNS root, a process that has already begun under the management of the Internet Corporation for Assigned Names and Numbers (ICANN), according to the report. ICANN so far has approved 13 country and territory applications in the evaluation phase.

Other recommendations include using global forums to discuss DNS security issues; using the results of internationally supported studies to improve DNS structure; increasing information sharing across the DNS community; and establishing norms of behavior for cyberspace.

What industry can teach government about IT innovation and efficiency. Also in the new, all-digital issue of InformationWeek Government: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)