Is today really Black Thursday for Cyber Attackers?

By admin | July 15, 2010 | 1 Comment 

admin

dv1163013Today the Domain Name System Security Extensions (DNSSEC) protocol public key gets added to the ‘root’ name servers. Some commentators such as Alex Pawlik quoted in ZD Net predict it will be a ‘Black Thursday’ for cyber attackers with malicious DNS re-directs becoming a thing of the past. I’m not so sure we should talk about this in terms of it being a panacea but it’s certainly a step in the right direction.

The implementation of DNSSEC has been a long time in coming and each milestone passed is a very necessary step in the right direction. The signing of responses from the 13 root zone server clusters today should be seen in that context—it’s a start and a very big start. However, any expectation that this milestone marks the date that the Internet suddenly becomes safe is exaggerated.

To be effective, DNSSEC needs to be implemented down the whole DNS chain, from the root down to your ISP or company, so there are still many more milestones to be achieved before DNSSEC can achieve some of its promise, even if cyber criminals don’t identify ways around the signed response safeguard.

Kevin Hogan

comments

One Response to “Is today really Black Thursday for Cyber Attackers?”

  1. Chuck Kisselburg on July 15th, 2010

    Good post, Kevin!

    You are correct in that DNSSEC is a positive and necessary step forward. You are also correct in that while DNSSEC is one of they keys towards providing for a secure ‘net, it is not the sole function that protects users on the ‘net. However, DNSSEC is an important piece to the security puzzle. You are also correct in that for DNSSEC to be fully implemented it needs to be implemented down the whole DNS chain to the registrar and ISP. Ultimately it will be the domain owner who decides when their name should be signed.

    There is a tool, Security-DNS.net (http://www.Security-DNS.net), that allows for easier and quicker adoption of DNSSEC as it can be utilized by registrars and ISPs to help their customers with signing. Individual domain owners can also sign their own names for delivery to their respective registry, should they wish. Also, enterprises and registries can also utilize this tool for the signing of their zones.

Leave a Reply