497 KB | 3 files | PDF
Signature-based DNS security extensions have given hackers a way to scope out information on networks before they begin a direct attack. This paper looks at methods for mitigating this risk while still using DNSSEC to augment Internet security.
The Domain Name System is the global lookup service for network resources. To protect DNS information, the DNS security extensions have been developed and deployed on branches of the DNS to provide authentication and integrity protection using digital signatures. However, signed DNS nodes were found to have an unfortunate side effect: An attacker can query them as reconnaissance before attacking hosts on a particular network.
There are different ways a zone administrator can minimize information leakage and still take advantage of DNSSEC for integrity and source authentication. This article from the National Institute of Standards and Technology describes the risk and examines the protocol and operational options and looks at their advantages and drawbacks.
Included in this zip file are:
This excerpt focuses on the conceptual aspects of defect management, including the basic concepts of a defect, how to manage defects, and an analysis of the root causes of defects. ... More >>
This document makes recommendations for how users and developers should select checklists from the NIST National Checklist Repository, evaluate and test checklists, and apply them to IT products. ... More >>
This publication is intended to assist organizations in understanding the basics of application whitelisting. It also explains planning and implementation for whitelisting technologies throughout the security deployment lifecycle. ... More >>