DNS Security Guide

Txawm lub tuam txhab ua li cas, kev ruaj ntseg DNS yuav tsum yog ib feem tseem ceeb ntawm nws txoj kev npaj ruaj ntseg. Cov kev pabcuam npe, uas daws cov npe hostname rau IP chaw nyob, yog siv los ntawm txhua daim ntawv thov thiab kev pabcuam hauv lub network.

Yog tias tus neeg tawm tsam tau txais kev tswj hwm ntawm lub koom haum DNS, nws tuaj yeem yooj yim:

• muab koj tus kheej tswj hwm cov peev txheej sib koom
• redirect tuaj emails nrog rau kev thov hauv web thiab authentication sim
• tsim thiab siv tau SSL/TLS daim ntawv pov thawj

Phau ntawv qhia no saib DNS kev ruaj ntseg los ntawm ob lub ces kaum:

1. Ua haujlwm tsis tu ncua thiab tswj xyuas DNS
2. Yuav ua li cas cov txheej txheem DNS tshiab xws li DNSSEC, DOH thiab DoT tuaj yeem pab tiv thaiv kev ncaj ncees thiab tsis pub leej twg paub ntawm kev xa DNS thov

DNS kev ruaj ntseg yog dab tsi?

Lub tswv yim ntawm DNS kev ruaj ntseg suav nrog ob yam tseem ceeb:

1. Ua kom muaj kev ncaj ncees tag nrho thiab muaj cov kev pabcuam DNS uas daws cov hostnames rau IP chaw nyob
2. Saib xyuas DNS kev ua ub no txhawm rau txheeb xyuas qhov teeb meem kev nyab xeeb nyob qhov twg ntawm koj lub network

Vim li cas DNS muaj kev cuam tshuam rau kev tawm tsam?

DNS thev naus laus zis tau tsim nyob rau hauv cov hnub thaum ntxov ntawm Internet, ntev ua ntej leej twg txawm pib xav txog kev ruaj ntseg network. DNS ua haujlwm yam tsis muaj kev lees paub lossis kev encryption, ua qhov muag tsis pom kev thov los ntawm txhua tus neeg siv.

Vim tias qhov no, muaj ntau txoj hauv kev los dag cov neeg siv thiab tsis lees paub cov ntaub ntawv hais txog qhov chaw daws teeb meem ntawm cov npe rau IP chaw nyob tiag tiag.

DNS Security: Cov teeb meem thiab cov khoom siv

DNS kev ruaj ntseg muaj ntau yam yooj yim yam, txhua yam uas yuav tsum tau coj mus rau hauv tus account kom ua tiav kev tiv thaiv:

• Txhim khu kev ruaj ntseg server thiab cov txheej txheem tswj: nce qib ntawm kev ruaj ntseg neeg rau zaub mov thiab tsim ib tug qauv commissioning template
• Kev txhim kho raws tu qauv: siv DNSSEC, DoT lossis DoH
• Analytics thiab qhia: ntxiv ib qho kev tshwm sim DNS rau koj SIEM system rau cov ntsiab lus ntxiv thaum tshawb xyuas qhov xwm txheej
• Cyber ​​​​Intelligence thiab Threat Detection: sau npe rau ib qho kev hem thawj kev txawj ntse pub
• Automation: tsim cov ntawv sau ntau npaum li sai tau los ua kom cov txheej txheem automate

Cov saum toj no-hais txog qib siab tsuas yog lub ntsis ntawm DNS kev ruaj ntseg iceberg. Hauv seem tom ntej no, peb yuav nkag mus rau hauv cov ntaub ntawv siv tshwj xeeb thiab cov kev coj ua zoo tshaj plaws uas koj xav paub txog.

DNS tawm tsam

• DNS spoofing lossis cache lom: siv lub cev tsis muaj zog los tswj cov DNS cache kom hloov cov neeg siv mus rau lwm qhov chaw
• DNS tunneling: Feem ntau yog siv los hla kev tiv thaiv tej thaj chaw deb
• DNS hijacking: redirecting ib txwm DNS khiav mus rau lwm lub hom phiaj DNS server los ntawm kev hloov tus sau npe sau npe
• NXDOMAIN nres: ua DDoS nres ntawm tus neeg siv DNS uas tso cai los ntawm kev xa cov lus nug tsis raug cai kom tau txais cov lus teb yuam
• phantom domain: ua rau DNS daws tau tos cov lus teb los ntawm cov chaw tsis muaj nyob, ua rau kev ua haujlwm tsis zoo
• nres ntawm random subdomain: Kev cuam tshuam cov tswv thiab botnets tso tawm DDoS nres ntawm qhov chaw siv tau, tab sis tsom rau lawv cov hluav taws ntawm cov subdomains cuav kom yuam DNS server los saib cov ntaub ntawv thiab tswj xyuas cov kev pabcuam.
• domain thaiv: yog xa ntau cov lus teb spam los thaiv DNS server cov peev txheej
• Botnet nres los ntawm cov neeg siv khoom siv: ib qho kev sau ntawm cov khoos phis tawj, modems, routers thiab lwm yam khoom siv uas mloog zoo rau kev suav lub zog ntawm lub vev xaib tshwj xeeb kom overload nws nrog kev thov tsheb.

DNS tawm tsam

Kev tawm tsam uas qee yam siv DNS los tua lwm lub tshuab (piv txwv li hloov DNS cov ntaub ntawv tsis yog lub hom phiaj kawg):

• Fast-Flux
• Tib Flux Networks
• Ob chav Flux Networks
• DNS tunneling

DNS tawm tsam

Kev tawm tsam uas ua rau tus IP chaw nyob xav tau los ntawm tus neeg tawm tsam raug xa rov qab los ntawm DNS server:

• DNS spoofing lossis cache lom
• DNS hijacking

DNSSEC yog dab tsi?

DNSSEC - Lub Npe Lub Npe Kev Pabcuam Kev Ruaj Ntseg - yog siv los txheeb xyuas cov ntaub ntawv DNS yam tsis tas yuav tsum paub cov ntaub ntawv dav dav rau txhua qhov kev thov DNS tshwj xeeb.

DNSSEC siv Digital Signature Keys (PKIs) los xyuas seb cov txiaj ntsig ntawm cov lus nug lub npe tuaj ntawm qhov chaw siv tau.
Kev siv DNSSEC tsis yog tsuas yog kev coj ua zoo tshaj plaws hauv kev lag luam, tab sis nws kuj tseem siv tau zoo los tiv thaiv DNS tawm tsam feem ntau.

DNSSEC ua haujlwm li cas

DNSSEC ua haujlwm zoo ib yam li TLS/HTTPS, siv pej xeem thiab ntiag tug tus khub tseem ceeb rau digitally kos npe rau DNS cov ntaub ntawv. General piav qhia ntawm tus txheej txheem:

1. Cov ntaub ntawv DNS tau kos npe nrog tus khub tus kheej ntiag tug
2. Cov lus teb rau DNSSEC cov lus nug muaj cov ntaub ntawv thov nrog rau kos npe thiab pej xeem tus yuam sij
3. ces pej xeem key siv los sib piv qhov tseeb ntawm cov ntaub ntawv thiab kos npe

DNS thiab DNSSEC Security

DNSSEC yog ib qho cuab yeej los xyuas qhov tseeb ntawm DNS queries. Nws tsis cuam tshuam rau DNS ntiag tug. Hauv lwm lo lus, DNSSEC tuaj yeem muab kev ntseeg siab rau koj tias cov lus teb rau koj cov lus nug DNS tsis tau raug cuam tshuam nrog, tab sis txhua tus neeg tawm tsam tuaj yeem pom cov txiaj ntsig zoo li lawv tau xa tuaj rau koj.

DoT - DNS dhau TLS

Thauj Txheej Kev Ruaj Ntseg (TLS) yog tus txheej txheem cryptographic los tiv thaiv cov ntaub ntawv xa mus rau kev sib txuas hauv network. Thaum muaj kev ruaj ntseg TLS kev twb kev txuas yog tsim los ntawm cov neeg siv khoom thiab cov neeg rau zaub mov, cov ntaub ntawv xa mus yog encrypted thiab tsis muaj intermediary tuaj yeem pom nws.

TLS Feem ntau siv los ua ib feem ntawm HTTPS (SSL) hauv koj lub web browser vim tias kev thov raug xa mus rau HTTP servers ruaj ntseg.

DNS-over-TLS (DNS dhau TLS, DoT) siv TLS raws tu qauv los encrypt UDP kev khiav tsheb ntawm kev thov DNS tsis tu ncua.
Encrypting cov lus thov no hauv cov ntawv dawb pab tiv thaiv cov neeg siv lossis cov ntawv thov thov los ntawm ntau qhov kev tawm tsam.

• MitM, los yog "txiv neej nyob nruab nrab": Yog tias tsis muaj encryption, qhov nruab nrab nruab nrab ntawm tus neeg siv khoom thiab tus neeg siv kev tso cai DNS tuaj yeem xa cov ntaub ntawv tsis tseeb lossis txaus ntshai rau tus neeg siv khoom teb rau qhov kev thov
• Espionage thiab taug qab: Yog tsis muaj encrypting thov, nws yog ib qho yooj yim rau nruab nrab nruab nrab saib seb qhov chaw twg ib tug tshwj xeeb cov neeg siv los yog daim ntawv thov nkag. Txawm hais tias DNS ib leeg yuav tsis qhia cov nplooj ntawv tshwj xeeb uas tau mus xyuas hauv lub vev xaib, tsuas yog paub txog cov npe thov txaus los tsim cov profile ntawm ib qho system lossis ib tus neeg.

Tau qhov twg los: Tsev kawm ntawv ntawm California Irvine

DoH - DNS dhau HTTPS

DNS-dhau-HTTPS (DNS dhau HTTPS, DoH) yog qhov kev sim raws tu qauv txhawb nqa ua ke los ntawm Mozilla thiab Google. Nws cov hom phiaj zoo ib yam li DoT raws tu qauv - txhim kho tib neeg txoj kev ceev ntiag tug hauv online los ntawm kev encrypting DNS thov thiab cov lus teb.

Standard DNS queries raug xa hla UDP. Kev thov thiab cov lus teb tuaj yeem taug qab siv cov cuab yeej xws li Wireshark. DoT encrypts cov kev thov no, tab sis lawv tseem raug txheeb xyuas raws li qhov sib txawv ntawm UDP kev khiav tsheb hauv lub network.

DoH siv txoj hauv kev sib txawv thiab xa encrypted hostname daws teeb meem thov dhau HTTPS kev sib txuas, uas zoo li lwm qhov kev thov hauv web hauv lub network.

Qhov sib txawv no muaj qhov cuam tshuam tseem ceeb rau ob qho tib si rau cov thawj coj hauv lub cev thiab rau yav tom ntej ntawm kev daws teeb meem lub npe.

1. DNS filtering yog ib txoj hauv kev los lim cov tsheb khiav hauv lub vev xaib los tiv thaiv cov neeg siv los ntawm phishing tawm tsam, cov chaw uas faib cov malware, lossis lwm yam kev ua phem hauv Is Taws Nem ntawm cov tuam txhab network. DoH raws tu qauv hla dhau cov lim dej no, muaj peev xwm nthuav tawm cov neeg siv thiab lub network kom muaj kev pheej hmoo ntau dua.
2. Hauv cov qauv kev daws teeb meem tam sim no, txhua lub cuab yeej ntawm lub network ntau dua lossis tsawg dua tau txais cov lus nug DNS los ntawm tib qhov chaw (tus neeg siv DNS tau teev tseg). DoH, thiab tshwj xeeb tshaj yog Firefox qhov kev siv ntawm nws, qhia tias qhov no yuav hloov pauv yav tom ntej. Txhua daim ntawv thov ntawm lub khoos phis tawj tuaj yeem tau txais cov ntaub ntawv los ntawm cov chaw DNS sib txawv, ua rau muaj teeb meem, kev nyab xeeb, thiab kev pheej hmoo ua qauv ntau dua.

Tau qhov twg los: www.varonis.com/blog/what-is-powershell

Dab tsi yog qhov txawv ntawm DNS dhau TLS thiab DNS dhau HTTPS?

Cia peb pib nrog DNS dhau TLS (DoT). Lub ntsiab lus tseem ceeb ntawm no yog tias tus thawj DNS raws tu qauv tsis hloov, tab sis tsuas yog kis tau yooj yim dhau ntawm kev ruaj ntseg channel. DoH, ntawm qhov tod tes, tso DNS rau hauv HTTP hom ua ntej thov.

DNS Monitoring Alerts

Lub peev xwm los saib xyuas DNS tsheb khiav hauv koj lub network kom muaj kev tsis txaus ntseeg yog qhov tseem ceeb rau kev tshawb pom ntxov ntawm kev ua txhaum cai. Siv lub cuab yeej zoo li Varonis Edge yuav muab koj lub peev xwm nyob rau saum toj ntawm txhua qhov kev ntsuas tseem ceeb thiab tsim cov profiles rau txhua tus account hauv koj lub network. Koj tuaj yeem teeb tsa kev ceeb toom kom raug tsim los ntawm kev sib xyaw ua ke uas tshwm sim nyob rau lub sijhawm tshwj xeeb.

Saib xyuas DNS kev hloov pauv, qhov chaw nyob ntawm tus account, siv thawj zaug thiab nkag mus rau cov ntaub ntawv rhiab, thiab tom qab cov sijhawm ua haujlwm tsuas yog qee qhov kev ntsuas uas tuaj yeem cuam tshuam los tsim cov duab pom dav dua.

Tau qhov twg los: www.hab.com