Hello, everyone. This is Susan Bradley, for CSOOnline. Today, I'm going to talk about
two different things about domain name services or DNS. One is for the admin and the other
on the workstation side. First on the admin side, it happened the other day that I was
making some changes to some DNS settings for a site that I manage. And I realized in logging
in that I hadn't changed the password for that site in years. And I stopped to think,
hmm, how easy it would be for attackers to possibly guess that password and get into
the system. It's pretty easy to look up to see who's hosting DNS in your environment
and then possibly guess on the username and password. It is honestly not the first time
that attackers have gone after DNS as a basic way to attack us. Log in to a DNS hoster,
make changes to the settings in their records and off you go. So just like I'm obviously
saying a lot about two factor authentication for such things as Office 365. I want you
to think about two factor authentication for anything in your environment, especially things
like DNS, because if an attacker can log in and make changes, that's not a good thing.
Microsoft is making several changes in the way of DNS. Are you aware that in Azure that
you can use it to create DNS and even private DNS settings? Go into your Azure portal, go
into create a resource. And from here, it may be just as easy to do search.
Click on DNS zone. You want to create. We're going to start a free account. We're going
to set up a testing DNS. And we're going to pick a location.
And from here, it starts to look like any pretty traditional DNS hoster where you can
put in your records those you need. And obviously Azure supports two factor authentication.
Microsoft has also recently rolled out as a private DNS where you can use your own custom
domain names rather than Azure provided names. But there's another DNS for domain name services
I want you to think about. And that's when your workstations in your environment go out
to the Internet and research and ask for responses back. So anytime you go to a Web site and
you say, hey, I want to go to, let's say CNN or Facebook or wherever, there's a a transmission
that goes out from your network out to an DNS provider and says, hey, I want to look
that up. I'm looking at wire shark transmission here, and you can see that the transmission
is going out Port 53 and they're pretty much in plain text. So you can see what your workstations
are going out and searching for and some of that information can be pretty and from it
informational. Microsoft recently announced that they're planning to move DNS over HTTPS
or encrypted DNS traffic. Now note this is not the same as
DNSSEC or DNS security extensions is a security protocol that digitally signs data to and
help ensure its validity. Indeed, DNSSEC, in order to ensure a secure look up the signing
must happen at every level in the DNS lookup process. Now DNSSEC has been around for many,
many years and can be set up on server platforms as old as 2012, but it's not supported right
now in Azire DNS over HTTPS is intended to protect your searches and traffic. It's a
new technology that encrypts your DNS queries so that only the intended recipient can decrypt
and read them. Firefox, in fact, has actually come out supporting DNS over HTTPS. If you
go into preferences networking connection settings down here at the bottom, you can
click a box enabled DNS server over HTTPS and choose their default provider CloudFlare.
CloudFlare and Firefox have made a deal where they've agreed to log less data about the
Firefox users. Basically, Firefox has mandated exactly what will be tracked and what won't.
Or you can choose a custom DNS provider of your choice.
There's several here in that list there. What they provide and what they support.
Chrome will support the DNS over HTTPS, but it's not quite as easy to set it up in order
to enable it. You have to go into the properties of Chrome and add a very nasty string here.
To the back end and save it.
Click OK, relaunch Chrome and it will now be providing HTTPS over DNS. Or rather, I
should say, DNS over HTTPS. There there's also a DNS over TLS, which is another option,
but at this time not many browsers support it. So think of ways that you can protect
both your domain name services from attacks as well as browsing ants and searching on
your network.
Big data is a big problem these days. Think about ways to protect more information coming
into and out of your environment.
Domain name services is such a foundational function in windows we too often take it for
granted. Think of ways to increase its protection both in terms of your firm's needed protections
as well as protecting your workstations from snooping. And as always, don't forget to sign
up for tech talk from IDG, the new YouTube channel for the tech news of the Day. Until
next time. This is Susan Bradley for CSO Online. Thanks again.