NSA, CISA Promote Domain Name System Incorporating Threat Information

Federal cybersecurity agencies outlined the benefits and risks of using services that assimilate information on threats into the system that routes users through the internet to help avoid visits to malware-ridden websites.

The Domain Name System translates the names users type into a browser to numerical IP addresses and connects them to their destinations through a protocol of queries and replies. But the system can be manipulated by malicious actors. Encryption services such as DNS over Hypertext Transfer Protocol over Transport Layer Security, or DNS over HTTPs, can make it harder for threat actors to make out their target traffic.

“Protective DNS” (PDNS) is different from earlier security-related changes to DNS in that it is envisioned as a security service – not a protocol – that analyzes DNS queries and takes action to mitigate threats, leveraging the existing DNS protocol and architecture,” reads a guide the National Security Agency and Cybersecurity and Infrastructure Security Agency published jointly this month.  

  The document describes all the ways such services can improve security, implementation pitfalls, and a side-by-side comparison of six providers’ capabilities in areas like deployability over hybrid architectures, support for other security features, and protection against algorithms that generate malware domains.

It draws on a pilot of the secure DNS technology which then-NSA Cybersecurity Director Anne Neuberger said in June would foil 92% of malware attacks. 

“Over a six-month period, the PDNS service examined more than 4 billion DNS queries to and from the participating networks, blocking millions of connections to identified malicious domains,” the NSA said of the pilot in a press release.

The guide notes that “protecting users’ DNS queries is a key defense because cyber threat actors use domain names across the network exploitation lifecycle.” That includes the ability to stem phishing attacks used for credential harvesting and threat actors exfiltrating data from a compromised device to a remote host, among other phases of a cyberattack.   

But the agencies cautioned PDNS is not a comprehensive network defense approach.

“It should be noted that one inherent constraint of PDNS is that it is bypassed by any traffic using IP addresses directly without doing DNS lookups. For this reason, customers should not rely on it alone to detect and prevent malicious traffic,” the guide says, adding, “Some PDNS services may provide additional non-DNS related capabilities or integration with other security capabilities as well.”

The guide noted that some enterprise domain resolvers—machines used in the routing process—still don’t support security features like the encryption of DNS over HTTPs or Domain Name System Security Extensions (DNSSEC), a set of specifications outlined by the Internet Engineering Task Force. But many PDNS providers will add these services in along with their core function of integrating threat information as they block access to malicious sites, the guide said. 

All but one of the six providers the agencies reviewed—Akami ETP, BlueCat Networks DNS Edge, Cisco Umbrella DNS SE, EfficientIP DNS Guardian, Neustar UltraDNS and Nominet Protective DNS—met all of the criteria listed.

BlueCat Networks DNS Edge was listed as not supporting DNSSEC or DNS over HTTPs. 

The NSA and CISA were careful to note that their publication does not endorse any one provider over another, and stressed that customers should make decisions based on what’s best for their own enterprise architectures.