3 ms·
> DNS logs are important in an enterprise. But I'm sure many would want to also use DoH. Really? Why? As someone who works in academia, I don't see why anyone
by cosmojg 6y ago
> DNS logs are important in an enterprise. But I'm sure many would want to also use DoH.
Really? Why? As someone who works in academia, I don't see why anyone would need access to my or my colleagues' DNS logs, but I understand things might be different in industry.
- egyptiankarim 6y ago"Important" in the sense that many IT organizations have predicated their data forensics and incident response capabilities on being able to intercept and analyze traffic at arbitrary points within their corporate networks. That's not to say that those choices reflect good architectural design, to be sure quite the opposite. But like many things in enterprise IT risk management, it comes down to where you spent your money, and things like DoH/DoT force will force certain organizations to admit "a lot in the wrong place".
- dsl 6y agoMuch of this comes from regulatory oversight of specific industries. DoH isn't going to fly in the banking sector for example.
- staticassertion 6y agoTo be clear, I'm not asking for the ability to intercept DNS requests, or encrypted traffic, at all. I'm fine (and encourage) encryption on the wire. I'm just as happy to get the logs on the local system, and ship them off.
- m3047 6y ago> As someone who works in academia I wouldn't blame or ride on academia. If you have no data worth exfiltration, experiments worth sabotaging or industry affiliations you might be right.
- staticassertion 6y agoExtremely helpful for detecting malware, or performing post-compromise IR.