{"id":1283,"date":"2023-03-16T12:20:50","date_gmt":"2023-03-16T12:20:50","guid":{"rendered":"https:\/\/efficientip.com\/?p=67734"},"modified":"2023-06-06T23:55:02","modified_gmt":"2023-06-06T23:55:02","slug":"data-theft-via-dns-are-you-safe","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/03\/16\/data-theft-via-dns-are-you-safe\/","title":{"rendered":"Data Theft via DNS \u2013 Are You Safe?"},"content":{"rendered":"

<\/p>\n

With cybercriminals using increasingly sophisticated mechanisms, and insider threats still prevalent, organizations have come to accept that the threat of a data breach is here to stay. Rather than wondering \u201cif\u201d my business will become a victim of data theft or ransomware, the question now is \u201cwhen\u201d. The market stats are pretty scary: according to AV-Test Institute, more than 1 billion malware programs exist, and Sonic Wall\u2019s 2022 report states that 40 million ransomware attacks occur every month. <\/span><\/p>\n

Despite all the protection methods put in place by companies, one component is often overlooked \u2013 their DNS. Being open by design, DNS is a favorite service to utilize for exfiltrating data without being easily detected by firewalls and IPSs. So to ensure data confidentiality, as well as for avoiding regulatory fines like GDPR, US Cloud Act, and PDPA, specialized DNS Security mechanisms and tools to detect exfiltration via DNS have become imperative.<\/span><\/p>\n

Why DNS is a Favorite Service for Data Theft<\/b><\/p>\n

DNS is an open service by essence, enabling connection with external apps (websites, Cloud etc..). <\/span>But as DNS isn\u2019t generally associated with data delivery, it is often overlooked. <\/span><\/p>\n

\u201cDNS is rarely monitored and analyzed, and the DNS tunneling activity usually slips under the radar. This makes DNS exfiltration an \u201ceasier\u201d option than other means of data theft.\u201d <\/i>\u2013 Duncan Brown, VP European Security, IDC<\/i><\/strong><\/p>\n

Cybercriminals benefit from this assumption to bypass security mechanisms for transporting sensitive data from inside to outside the enterprise. The DNS protocol is used as either a tunneling protocol or as a \u2018file transfer\u2019 protocol. <\/span>Palo Alto research shows that over 80% of malware uses DNS to identify a command-and-control (C2) server to steal data and spread malware\/ransomware. <\/span><\/p>\n

Firewalls and DLP systems find it difficult to detect this exfiltration in a timely manner, so most businesses don\u2019t even know that data is being stolen until it\u2019s too late.<\/span><\/p>\n

Conventional Network Security Components are Limited<\/b><\/p>\n

Many organizations we speak to feel confident with their data protection. They have DNS security on their firewalls, they have endpoint protection, IDS, IDP, network traffic analysis tools, plus email and web filtering to ensure \u201cthe nasty stuff\u201d doesn\u2019t reach their users. Whilst these tools are excellent, their threat analysis methods to detect data exfiltration is limited. So when businesses run tests using EfficientIP\u2019s test tool, they pretty much always find that data can be easily exfiltrated via their DNS. According to <\/span>IDC\u2019s 2022 Global DNS Threat survey<\/span><\/a>, one in four organizations confirmed they have suffered data theft via DNS.<\/span><\/p>\n

NGFWs, for example, often use pattern matching, signatures, and databases of known bad\/malicious domains. But what if the threat isn\u2019t able to be pattern matched? Or the domain is not yet identified as a bad domain? Hackers are smart and tend to use domains with good reputation to walk through security systems!<\/span><\/p>\n

To protect data confidentiality, organizations need to look beyond traditional security. Performing checks close to \u201cthe source\u201d, such as by investigating DNS data coming from end-users, would make a lot of sense. This enables verification of \u201cintent\u201d before malicious transactions are able to start. In addition, it allows considerable load to be taken off the firewalls which are already very busy. <\/span>It all comes back to having defense in depth across your cyber security stack. <\/span><\/p>\n

How to Better Secure Your DNS<\/b><\/p>\n

When it comes to securing DNS, the ideal method is to use the DNS itself. Monitoring DNS transactions is a great start, but it becomes even more valuable when intelligent analysis is applied. Making use of user behavior analytics and client context information significantly increases insight into potential exfiltration attempts. <\/span><\/p>\n

EfficientIP\u2019s approach to data protection<\/span><\/a> consists of: <\/span><\/p>\n