3 ms·
In a corporate environment you need to block all the DNS traffic to external resolvers, except the company monitored DNS resolvers. If you have a SIEM that moni
by lormayna 3y ago
In a corporate environment you need to block all the DNS traffic to external resolvers, except the company monitored DNS resolvers. If you have a SIEM that monitor the queries, it will be easy to identify the majority of attacks.
- sybercecurity 3y agoIt's amazing how enterprises are only now doing this. Stub resolvers should not be sending queries anywhere but designated recursive resolvers for the network. It's easy to block outbound ports.
- insanitybit 3y agoOh, yes you should absolutely do that. What I meant is that in the case of prod you can stop all recursive DNS beyond the resolvers you own. But absolutely, all DNS should have to go through resolvers that you own.