Feeds

Kaminsky calls for DNSSEC deployment

Political hot potato

SANS - Survey on application security programs

ARLINGTON, VA. -- Dan Kaminsky's second act has begun: Pushing the adoption of the DNSSEC security standard for the domain-name system.

So many security frameworks — from password resets via e-mail to SSL certificates — rely on DNS in some way that the protocol has to be secured for Internet security to work, Kaminsky told attendees at the Black Hat DC Security Briefings. DNSSEC is by far the leading security standard for the domain-name system, and the US government has already committed to deploying the protocol this year.

However, DNSSEC is hard to deploy and maintain and is a political hot potato, because in the simplest case, a single root — administered by the U.S. Department of Commerce — would authenticate the entire domain-name system for the Internet, Kaminsky said. Yet, other countries can maintain their own root servers for their domains, and as long as the servers are maintained, the DNS system will continue to work, he said.

"Politics is getting in our way more than security," Kaminsky said. "It's time to sign the root and be done with it."

Last July, Kaminsky and a number of Internet infrastructure companies announced that he had discovered a significant attack on the domain-name system. The companies issued patches for their products, but within three weeks, online attackers had already started using the flaw to attack some popular domains. Many DNS servers remain unpatched, he said.

Kaminsky, who is the director of penetration testing for security firm IOActive, has taken two months leave from his work to advocate DNSSEC adoption, he told SecurityFocus.

The researcher also argued for simple implementations of DNSSEC. While the protocol is fine, DNSSEC systems are not easy to deploy or maintain. Without automation, administrators will keep putting off deployments, he stressed.

This article originally appeared in SecurityFocus.

Copyright © 2008, SecurityFocus

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.