DNS threats emerge as IoT sticking point – TechTarget

rvlsoft – Fotolia
IT pros must not overlook DNS threats created by IoT security risks when they introduce IoT devices into their organization.
IoT achieves value primarily through connectivity, including data gathering and actions linked to analysis and decision-making. IoT device connections rely heavily on the DNS, a 1980s-vintage decentralized naming system. However, DNS may not be ready for the scale, traffic and security expectations of today’s connected devices.
Some high-profile attacks have taken advantage of DNS, such as a sophisticated cyberespionage campaign known as DNSpionage that Cisco Talos security researchers discovered in 2018. The U.S. Department of Homeland Security put out a notification to government agencies in early 2019 advising them to ensure DNS security across their domains. That kind of action has raised awareness of DNS threats, said Enterprise Strategy Group analyst John Grady.
IT pros must consider the different types of attacks that use DNS, including availability or distributed denial-of-service (DDoS) attacks, malicious redirects for the introduction of malware or exfiltration of data via DNS tunneling. All those concerns have driven new attention to DNS.
“Basically, if you don’t secure DNS, you’re open to a number of different threat vectors,” Grady said.
DNS vendors and operators began one initiative to address DNS concerns called DNS Flag Day that focuses on implementing extension mechanisms for DNS to enhance security. DNS Flag Day 2020 will focus on DNS-over-TCP, especially IP packet fragmentation. Additionally, IT pros have shown increased interest in encrypted DNS and adoption of DNSSEC, Grady said.
DNSSEC uses digital signatures based on public key infrastructure to ensure DNS data is accurate and unmodified and has originated from the domain owners. Encrypted DNS compares with traditional DNS in a similar way to how HTTPS compares to HTTP.
“As [DNSSEC] relates to IoT devices, for one example, it would help ensure that when a connected device reaches to the web for a software update, it’s being sent to the correct location and not being maliciously redirected,” Grady said.
Likewise, DNSSEC could ensure that IoT devices are not compromised for use in a botnet, which is a well-established attack pattern.
Internet Corporation for Assigned Names and Numbers published a report in 2019 addressing IoT and DNS threats and recommended that vendors try to address the risks. Users must also have good protection on their devices because experience has shown that malicious actors can load malware and create further attacks, said Merritt Maxim, an analyst at Forrester Research. DNS is not necessarily the weakest point; it may be that most often the devices are the problem, he said.
Manali De Bhaumik, assistant manager of IoT at analyst firm Information Services Group, agreed and said that businesses must recognize that IoT is rapidly becoming a significant threat conduit to DNS through ever-larger botnets. That implies that organizations must upgrade their industrial IoT (IIoT) protocol standards such as Message Queue Telemetry Transport and Open Platform Communications Unified Architecture.
“This enables a smooth convergence of IT and [operational technology] interoperability and security standards need to be raised with upgraded DNS services capable of handling DDoS traffic,” De Bhaumik said. Having multiple DNS services can also ensure continuity of key services and an additional DNS security layer for customer-premises equipment could detect various cyberattack patterns, she said.
Organizations must ensure the compatibility of their entire network with protocol upgrades. “[Upgrades] have IoT use cases, but for the most part, I don’t think deployment will be use-case specific, but rather all or nothing,” De Bhaumik said.
Another danger with IoT is that continuous software updates create an adverse side effect of loading burdens on the DNS.
“Even with proper security you could have a device that allows software updates and patches remotely, and if that isn’t written efficiently, similar devices could all be pinging at the same,” Maxim said. “When you’re talking millions or tens of millions of devices, that could create a DDoS effect because DNS can’t take the load.”
The fact that IoT devices are IP-enabled not only continues DNS playing a crucial role in the traditional IoT applications, but could present a significant threat, De Bhaumik said.
“Enterprises need to evaluate their existing on-premises DNS infrastructure efficiency,” she said.
“I think we’ll have chunks of the industry that will not address this and remain vulnerable relative to their IIoT deployments,” Grady said. On the other hand, the proposed changes to DNS that are designed to enhance security will take a long time to implement. “It will be a while before fundamental changes to the DNS infrastructure would render an IoT device useless,” he said.
Forrester analyst Greg Siegfried agreed.
“DNS has remained relatively compatible, and the idea that any changes like this would not eliminate more traditional way of resolving names is unlikely. We are talking about a period of maybe 10 to 20 years; it won’t be switched overnight,” he said.
Businesses of the future will rely on workers with IT skills even more than they do today. Find out which jobs might be most in …
Get guidance on how relevant cloud compliance standards are developed and tips on evaluating third-party providers’ cloud …
The Biden administration’s regulatory efforts have defined the U.S. approach to climate over the last four years. That could …
Corvus Insurance’s Peter Hedberg provided insight into the cyber insurance landscape after a tumultuous 2023 and what enterprises…
At re:Inforce 2024, AWS shared details of its secure-by-design measures to protect customer data.
The Biden administration announced a ban on Kaspersky Lab products inside the United States due to the antivirus vendor’s ties …
Experts at the Cisco Live 2024 conference discussed the future of AI in networks and how its use can help simplify network and …
Analysts Jim Frey and Jon Brown from Enterprise Strategy Group talk about their takeaways from the Cisco Live 2024 conference in …
As Mass General Brigham updated its network and invested in other upgrades, the hospital ecosystem also developed a measured …
A data center’s UPS might not be overloaded. Check loads on the circuits and balance all three phases as closely as possible to …
As climate change becomes a more pressing issue, these sustainability best practices can help your data center go greener, which …
StorMagic looks to court customers with smaller data centers for SMBs and the edge with SvHCI, a new VMware alternative with a …
The data management and analytics vendor’s embeddable database now includes streaming capabilities via support for Kafka and …
The vendor’s latest update adds new customer insight capabilities, including an AI assistant, and industry-specific tools all …
The data quality specialist’s capabilities will enable customers to monitor unstructured text to ensure the health of data used …
All Rights Reserved, Copyright 2005 – 2024, TechTarget

Privacy Policy
Cookie Preferences
Cookie Preferences
Do Not Sell or Share My Personal Information

source

About The Author

admin

See author's posts