4 ms·
So you're counting on malware's continued use of plaintext DNS as part of your network's security strategy?
by JoshTriplett 7y ago
So you're counting on malware's continued use of plaintext DNS as part of your network's security strategy?
- EvanAnderson 7y agoGiven that Cisco has a major product, Umbrella, that is sold as a part of enterprise security strategy I'd say that more than the OP is considering DNS filtering / monitoring as part of a network security strategy.
- throw0101a 7y agoIf anything hits port 53 on the outgoing gateway, and it's not from our recursive servers, then we know that network element needs to be looked at: either it's mis-configured or malicious. Anything that uses our recursive servers is monitored, and we can check against blacklists, either in real-time or after-the-fact through logging. * https://en.wikipedia.org/wiki/Domain_generation_algorithm https://en.wikipedia.org/wiki/Domain_generation_algorithm * https://en.wikipedia.org/wiki/Botnet#Domains https://en.wikipedia.org/wiki/Botnet#Domains If malware is connecting to hard-coded IPs then there's nothing we can do about that. So yes: monitoring DNS for suspicious activity is part of our security strategy.
- ecnahc515 7y agoThen your security strategy definitely needs improvements, since malware often uses hardcoded IPs to bypass DNS proxying/forwarding that corporate networks use. Seriously, this argument could be used to say we should be using HTTP instead of HTTPS, but anyone doing security knows if they really need that level of introspection they need to MITM HTTPS traffic with a MITM proxy. If you care that much, you also need to MITM DoH/DoT traffic.
- throw0101a 7y agoDNS sniffing takes care of a lot of low-hanging fruit.