Feeds

Kaminsky calls for DNSSEC deployment

Political hot potato

Combat fraud and increase customer satisfaction

ARLINGTON, VA. -- Dan Kaminsky's second act has begun: Pushing the adoption of the DNSSEC security standard for the domain-name system.

So many security frameworks — from password resets via e-mail to SSL certificates — rely on DNS in some way that the protocol has to be secured for Internet security to work, Kaminsky told attendees at the Black Hat DC Security Briefings. DNSSEC is by far the leading security standard for the domain-name system, and the US government has already committed to deploying the protocol this year.

However, DNSSEC is hard to deploy and maintain and is a political hot potato, because in the simplest case, a single root — administered by the U.S. Department of Commerce — would authenticate the entire domain-name system for the Internet, Kaminsky said. Yet, other countries can maintain their own root servers for their domains, and as long as the servers are maintained, the DNS system will continue to work, he said.

"Politics is getting in our way more than security," Kaminsky said. "It's time to sign the root and be done with it."

Last July, Kaminsky and a number of Internet infrastructure companies announced that he had discovered a significant attack on the domain-name system. The companies issued patches for their products, but within three weeks, online attackers had already started using the flaw to attack some popular domains. Many DNS servers remain unpatched, he said.

Kaminsky, who is the director of penetration testing for security firm IOActive, has taken two months leave from his work to advocate DNSSEC adoption, he told SecurityFocus.

The researcher also argued for simple implementations of DNSSEC. While the protocol is fine, DNSSEC systems are not easy to deploy or maintain. Without automation, administrators will keep putting off deployments, he stressed.

This article originally appeared in SecurityFocus.

Copyright © 2008, SecurityFocus

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.