Federal cybersecurity agencies outlined the benefits and risks of using services that assimilate information on threats into the system that routes users through the internet to help avoid visits to malware-ridden websites.
The Domain Name System translates the names users type into a browser to numerical IP addresses and connects them to their destinations through a protocol of queries and replies. But the system can be manipulated by malicious actors. Encryption services such as DNS over Hypertext Transfer Protocol over Transport Layer Security, or DNS over HTTPs, can make it harder for threat actors to make out their target traffic.
“Protective DNS” (PDNS) is different from earlier security-related changes to DNS in that it is envisioned as a security service – not a protocol – that analyzes DNS queries and takes action to mitigate threats, leveraging the existing DNS protocol and architecture,” reads a guide the National Security Agency and Cybersecurity and Infrastructure Security Agency published jointly this month.
The document describes all the ways such services can improve security, implementation pitfalls, and a side-by-side comparison of six providers’ capabilities in areas like deployability over hybrid architectures, support for other security features, and protection against algorithms that generate malware domains.
It draws on a pilot of the secure DNS technology which then-NSA Cybersecurity Director Anne Neuberger said in June would foil 92% of malware attacks.
“Over a six-month period, the PDNS service examined more than 4 billion DNS queries to and from the participating networks, blocking millions of connections to identified malicious domains,” the NSA said of the pilot in a press release.
The guide notes that “pro ..
Support the originator by clicking the read the rest link below.
