Your Domain Name System (DNS) infrastructure enables users to connect to web-based resources by translating everyday language into IP addresses. Imagine going into a restaurant, in the age before the internet, only to find that the staff speaks and the menu is written in a different language from yours. Without some shared communication form, you can’t order dinner, and they can’t give you what you want. Finally, someone comes into the restaurant who speaks both languages, acting as the translator so you can get the service you need.
A DNS infrastructure is the translator for cloud-based operations for continued services. However, when malicious actors target your DNS, a successful attack can lead to downtime or a data breach.
To mitigate risk, you should implement some DNS security best practices, including knowing what logs help you monitor for and detect a potential incident.
What is DNS security?
DNS security refers to the measures taken to protect the Domain Name System (DNS) infrastructure from cyber attacks. DNS translates a human-readable URL (Uniform Resource Locator) into a machine-readable IP address, routing user requests to the appropriate digital resources.
Cyber attacks against the DNS infrastructure can lead to:
- Website defacement
- Traffic hijacking sending users to malicious websites or intercepting communications
- Unauthorized access to sensitive information
- Distributed Denial of Service (DDoS) attacks causing service outages and business interruption
DNS security controls typically include:
- Redundancy: Using multiple DNS servers spread across different locations to prevent a single point of failure
- DNS Security Extensions (DNSSEC): Protocols providing authentication and data integrity
- DNS logging: Monitoring for and detecting malicious activities
Why is DNS security important?
The history of DNS gives insight into why it is not a secure technology. Originally created in 1983 so people could more easily navigate the nascent internet, no one predicted this new connectivity would change and become critical to daily operations.
Your DNS infrastructure acts as the foundation for your digital business operations meaning the service disruptions lead to downtime and lost revenue.
A successful attack against your DNS infrastructure can lead to:
- Business disruption: Without the ability to translate URLs into IP addresses, users and customers cannot connect to digital services.
- Lost revenue: Without the ability to connect to services, customers cannot engage in transactions, like being able to purchase items in an e-commerce store.
- Data breach: Compromising DNS services can lead to unauthorized data transfers, modification, or access that impact sensitive data’s integrity and privacy.
- Compliance risk: DNS is included in various compliance frameworks and mandates, including the Payment Card Industry Data Security Standard (PCI DSS) and International Organization for Standardization (ISO) 27002-2022
6 DNS Attack Types and How to Prevent Them
As attackers increasingly target the DNS infrastructure, knowing these four common attack types can help you implement security controls and the appropriate monitoring to mitigate risk.
DoS and DDoS
Many attacks against the DNS infrastructure fall into these categories, even if they use different methodologies for achieving the objective. Although similar, you should understand the following differences:
- Denial of Service (DoS): one computer using one internet connection sends high volumes of traffic to a remote server
- Distributed Denial of Service (DDoS): multiple devices across multiple internet connections target a resource, often using a botnet consisting of devices infected with malware
These attacks flood a DNS server with requests and traffic. As the server attempts to manage the responses, it becomes overloaded and shuts down.
DNS amplification attacks
One DDoS attack type is DNS amplification, in which malicious actors send high volumes of DNS name lookup requests to publicly accessible, open DNS servers. Instead of using their own IP in the source address, the attackers spoof the target’s address so that the DNS server responds to the target.
DNS hijacking
In a DNS hijacking attack, malicious actors make unauthorized changes to the DNS settings which redirect users to deceptive or malicious websites. Some varieties of DNS hijacking attack include:
- Cache poisoning: inserting false data into the DNS server’s cache to redirect users when they try to access the website
- Server hijacking: gaining unauthorized access to a domain’s DNS records and changing A or AAAA records that redirect users to a malicious IP address or attacker-controlled server
DNS Spoofing
DNS spoofing, also called DNS poisoning, exploits security gaps in the DNS protocol. The attacker gets in between the browser and the DNS server to supply the wrong response, diverting traffic to the malicious website.
DNS tunneling
DNS tunneling is a sophisticated attack where malicious actors insert data into the communication path between the browser and server. This enables them to bypass several defensive technologies, including:
- Filters
- Firewalls
- Packet capture
This process routes queries to a command and control (C2) server, enabling them to steal information.
DNS Logging Best Practices for Improved Security
Whether you build your own DNS infrastructure or use a managed service, you should be integrating your DNS logs into your overarching security monitoring. While the logs should provide similar information, the field used changes based on your DNS server’s manufacturer. However, you should look for log fields supporting the following categories and event types.
Zone operations
In DNS-speak, the zone refers to the domain. Some data you should consider collecting include log fields related to the creation, deletion, or modification to:
- Zones
- Records
- Nodes
DNS Security Extensions (DNSSEC)
DNSSEC are configurations that use digital signatures to authenticate DNS queries and responses. Some data you should consider collecting include log fields related to:
- Addition of new keys or trust points
- Removal of keys or trust points
- Exports of metadata
Policies
DNS policies allow you to
- Balance traffic loads
- Assign DNS clients based on geographic location
- Create zones
- Manage query filters
- Redirect malicious DNS requests to a non-existent IP address
Some data you should consider collecting include log fields related to the creation, deletion, or modification of:
- Client subnet records
- Server level policies
- Forwarding policies
- Zone policies
Graylog Security: Correlating DNS Log Events
DNS logs are often difficult to parse, sometimes creating a blind spot when monitoring DNS security. Graylog Security offers out-of-the-box content that streamlines this process with pre-built content to rapidly set up and start monitoring your DNS security.
Our prebuilt content to map security events to MITRE ATT&CK. By combining Sigma rules and MITRE ATT&CK, you can create high-fidelity alerting rules that enable robust threat detection, lightning-fast investigations, and streamlined threat hunting. For example, with Graylog’s security analytics, you can monitor user activity for anomalous behavior indicating a potential security incident. By mapping this activity to the MITRE ATT&CK Framework, you can detect and investigate adversary attempts at using Valid Accounts to gain Initial Access, mitigating risk by isolating compromised accounts earlier in the attack path and reducing impact.
Graylog’s risk scoring capabilities enable you to streamline your threat detection and incident response (TDIR) by aggregating and correlating the severity of the log message and event definitions with the associated asset, reducing alert fatigue and allowing security teams to focus on high-value, high-risk issues.
