Rough Outline. Introduction Why DNSSEC DNSSEC Theory Famous last words. Universiteit van Amsterdam, Sep 2006.

Size: px
Start display at page:

Download "Rough Outline. Introduction Why DNSSEC DNSSEC Theory Famous last words. http://www.nlnetlabs.nl/ Universiteit van Amsterdam, Sep 2006."

Transcription

1 page 2 Rough Outline An introduction to DNSSEC Olaf Kolkman 21 September 2006 Stichting (www.nlnetlabs.nl) Introduction Why DNSSEC DNSSEC Theory Famous last words page 3 DNSSEC evangineers of the day Olaf: DNS and DNSSEC research Protocol and software development (NSD) Co-Chair of the IETF DNSEXT working group Member of the Internet Architecture Board DNSSEC experience since about 2001 DNSSEC deployment at RIPE NCC DNSSEC Howto Net::DNS::SEC extensions RFC 4641 on DNSSEC operations page 4 Why DNSSEC Introducing DNSSEC Based on material developed while I was with the RIPE NCC. They are acknowledged for allowing me to re-use this material page 6 The Material 21 September 2006 Stichting Good security is multi-layered Multiple defense rings in physical secured systems page 7 page 8 page 9 Why DNSSEC The Problem DNS data published by the registry is being replaced on its path between the server and the client. This can happen in multiple places in the DNS architecture Good security is multi-layered Multiple defense rings in physical secured systems Multiple layers in the networking world Some places are more vulnerable to attacks then others Vulnerabilities in DNS software make attacks easier (and there will always be software vulnerabilities) DNS infrastructure Providing DNSSEC to raise the barrier for DNS based attacks Provides a security ring around many systems and applications Bourtange, source Wikipedia 1

2 Solution a Metaphor Compare DNSSEC to a sealed transparent envelope. The seal is applied by whoever closes the envelope Anybody can read the message The seal is applied to the envelope, not to the message page 10 Registrars/ Registrants Registry DB primary edu as DNS provider secondary Provisioning DNS Protocol DNS Architecture edu as friend secondary page 11 edu institution as ISP Cache server client Registrars Registrants Registry DB Provisioning Inter-server communication DNS Architecture DNS Protocol Server compromise Cache Poisoning page 12 Subject: tenure Astrophysics Mail Server Where? Example: Unauthorized mail scanning There! Central Admin Mail Server page 13 Subject: tenure Astrophysics Mail Server Where? Example: Unauthorized mail scanning Elsewhere Central Admin Mail Server page 14 Where Does DNSSEC Come In? DNSSEC secures the name to address mapping Tranport and Application security are just other layers. page 15 DNS DNS Bad Guy Bad Guy DNSSEC secondary benefits DNSSEC provides an independent trust path The person administering https is most probably a different from person from the one that does DNSSEC The chains of trust are most probably different See acmqueue.org article: Is Hierarchical Public-Key Certification the Next Target for Hackers? page 16 More benefits? With reasonable confidence perform opportunistic key exchanges SSHFP and IPSECKEY Resource Records With DNSSEC one could use the DNS for a priori negotiation of security requirements. You can only access this service over a secure channel page 17 DNSSEC properties DNSSEC provides message authentication and integrity verification through cryptographic signatures Authentic DNS source No modifications between signing and validation It does not provide authorization It does not provide confidentiality page 18 2

3 Other DNS security We talked about data protection The sealed envelope technology RRSIG, DNSKEY, NSEC and DS RRs There is also a transport security component Useful for bilateral communication between machines TSIG or SIG0 page 19 DNSSEC is essential for good layered security DNS protocol intrinsically easy to attack DNSSEC and Transport security Securing Host- Host Communication 21 September 2006 Stichting 21 September 2006 Stichting Registrars Registrants Registry DB TSIG Protection page 22 AXFR and IXFR Queries to caching forwarers Transaction Signature: TSIG TSIG (RFC 2845) Authorising dynamic updates and zone transfers Authentication of caching forwarders Independent from other features of DNSSEC One-way hash function DNS question or answer and timestamp Traffic signed with shared secret key Used in configuration, NOT in zone file page 23 Slave KEY: %sgs!f23fv SOA SOA Sig... verification TSIG Example Query: AXFR AXFR AXFR Sig... Sig... Master KEY: %sgs!f23f SOA SOA Sig... page 24 verification Provisioning DNS Protocol dynamic updates Response: Zone TSIG for Zone Transfers 1. Generate secret 2. Communicate secret 3. Configure servers 4. Test page 25 Importance of the Time Stamp TSIG/SIG(0) signs a complete DNS request / response with time stamp To prevent replay attacks Currently hardcoded at five minutes Operational problems when comparing times Make sure your local time zone is properly defined date -u will give UTC time, easy to compare between the two systems Use NTP synchronisation! page 26 Authenticating Servers Using SIG(0) Alternatively, it is possible to use SIG(0) Not yet widely used Works well in dynamic update environment Public key algorithm Authentication against a public key published in the DNS SIG(0) specified in RFC 2931 page 27 3

4 Cool Application Use TSIG-ed dynamic updates to configure configure your laptops name My laptop is know by the name of grover.secret-wg.org Mac OS users: there is a bonjour based tool. page 28 TSIG/Sig(0) Generate secret Configure servers DNSSEC Mechanisms New Resource Records Setting Up a Secure Zone Delegating Signing Authority Key Rollovers 21 September 2006 Stichting 21 September 2006 Stichting page 31 page 32 page 33 Registrars Registrants DNSSEC protection DNSSEC hypersummary The DNS is Not a PKI Registry DB Provisioning envelope sealed DNS Protocol Seal checked Seal checked Data authenticity and integrity by signing the Resource Records Sets with private key Public DNSKEYs used to verify the RRSIGs Children sign their zones with their private key Authenticity of that key established by signature/checksum by the parent (DS) Ideal case: one public DNSKEY distributed All key procedures are based on local policy A PKI is as strong as its weakest link Certificate Authorities control this through SLAs The DNS does not have Certificate Revocation Lists If the domain is under one administrative control you might be able to enforce policy Public Key Crypto Key pair: a private (secret) key and a corresponding public key Simplified: If you know the public key, you can verify a signature created with the private key If you know the public key, you can encrypt data that can only be decrypted with the private key DNSSEC only uses signatures PGP uses both methods page 34 Security Status of Data (RFC4035) Secure Resolver is able to build a chain of signed DNSKEY and DS RRs from a trusted security anchor to the RRset Insecure Resolver knows that it has no chain of signed DNSKEY and DS RRs from any trusted starting point to the RRset Bogus Resolver believes that it ought to be able to establish a chain of trust but for which it is unable to do so May indicate an attack but may also indicate a configuration error or some form of data corruption Indeterminate Resolver is not able to determine whether the RRset should be signed page September 2006 Stichting New Resource Records 4

5 page 37 page 38 page 39 RRs and RRSets Resource Record: name TTL class type rdata IN A RRset: RRs with same name, class and type: IN A A A RRSets are signed, not the individual RRs New Resource Records Three Public key crypto related RRs RRSIG Signature over RRset made using private key DNSKEY Public key, needed for verifying a RRSIG DS Delegation Signer; Pointer for building chains of authentication One RR for internal consistency NSEC Indicates which name is the next one in the zone and which typecodes are available for the current name authenticated non-existence of data DNSKEY RDATA 16 bits: FLAGS 8 bits: protocol 8 bits: algorithm N*32 bits: public key Example: ripe.net IN DNSKEY ( AQOvhvXXU61Pr8sCwELcqqq1g4JJ CALG4C9EtraBKVd +vgif/unwigfloa O3nHp/cgGrG6gJYe8OWKYNgq3kDChN) RRSIG RDATA 16 bits - type covered 8 bits - algorithm 8 bits - nr. labels covered 32 bits - original TTL ripe.net IN RRSIG A ( ripe.net. VJ+8ijXvbrTLeoAiEk/qMrdudRnYZM1VlqhN vhyuacyke2x/jqyfmfjfsurmhpo+0/gozjw 66DJubZPmNSYXw== ) signature field 32 bit - signature expiration 32 bit - signature inception 16 bit - key tag signer s name page 40 Delegation Signer (DS) Delegation Signer (DS) RR indicates that: delegated zone is digitally signed indicated key is used for the delegated zone Parent is authorative for the DS of the child s zone Not for the NS record delegating the child s zone! DS should not be in the child s zone page 41 DS RDATA 16 bits: key tag 8 bits: algorithm 8 bits: digest type 20 bytes: SHA-1 Digest $ORIGIN ripe.net. disi.ripe.net IN NS ns.disi.ripe.net disi.ripe.net IN DS ( 239af98b923c023371b52 1g23b92da12f42162b1a9 ) page 42 page 43 page 44 page 45 NSEC RDATA NSEC Records NSEC Walk Points to the next domain name in the zone also lists what are all the existing RRs for name NSEC record for last name wraps around to first name in zone N*32 bit type bit map Used for authenticated denial-of-existence of data authenticated non-existence of TYPEs and labels Example: IN NSEC ripe.net. A RRSIG NSEC NSEC RR provides proof of non-existence If the servers response is Name Error (NXDOMAIN): One or more NSEC RRs indicate that the name or a wildcard expansion does not exist If the servers response is NOERROR: And empty answer section The NSEC proves that the QTYPE did not exist More than one NSEC may be required in response Wildcards NSEC records are generated by tools Tools also order the zone NSEC records allow for zone enumeration Providing privacy was not a requirement at the time Zone enumeration is a deployment barrier Work has started to study solutions Requirements are gathered If and when a solution is developed, it will co-exist with DNSSEC-BIS! 5

6 Current Developments NSEC3 being tested All RR names hashed Hashed names are ordered opt-out for unsecured delegations possibilities SHA1 to be deprecated New hash for DS records Overlap, no flag day page 46 Other Keys in the DNS DNSKEY RR can only be used for DNSSEC Keys for other applications need to use other RR types CERT For X.509 certificates Application keys under discussion/development IPSECKEY SSHFP page 47 DNSSEC not a PKI Zone status New RRs: DNSKEY, RRSIG, NSEC, DS 21 September 2006 Stichting Delegating Signing Authority Chains of Trust Locally Secured Zones Key distribution does not scale!. net. com. money.net. kids.net. os.net. Secure entry points corp dop marnick mac unix nt dev market dilbert Out of band key-exchanges page 50 Using the DNS to Distribute Keys Secured islands make key distribution problematic Distributing keys through DNS: Use one trusted key to establish authenticity of other keys Building chains of trust from the root down Parents need to sign the keys of their children Only the root key needed in ideal world Parents always delegate security to child page September 2006 Stichting page 52 page 53 page 54 Key Problem Interaction with parent administratively expensive Should only be done when needed Bigger keys are better Signing zones should be fast Memory restrictions Space and time concerns Smaller keys with short lifetimes are better Key Functions Large keys are more secure Can be used longer Large signatures => large zonefiles Signing and verifying computationally expensive Small keys are fast Small signatures Signing and verifying less expensive Short lifetime Key solution: More Than One Key RRsets are signed, not RRs DS points to specific key Signature from that key over DNSKEY RRset transfers trust to all keys in DNSKEY RRset Key that DS points to only signs DNSKEY RRset Key Signing Key (KSK) Other keys in DNSKEY RRset sign entire zone Zone Signing Key (ZSK) 6

7 Walking the Chain of Trust page 55 Initial Key Exchange 1. 2 Child needs to: 4 RRSIG DNSKEY ( ) Hw9.. Send key signing keyset to parent 3 Parent needs to: net. DS ab15 RRSIG DS ( ) $ORIGIN ripe.net. Check childs zone 5 7 $ORIGIN net. net. DNSKEY ( ) q3dew (7834) ; KSK DNS KEY ( ) 5TQ3s (5612) ; ZSK RRSIG DNSKEY ( ) 7834 net. cmas... ripe.net. DS ab15 RRSIG DS ( ) net Verify if key can be trusted Generate DS RR A RRSIG A ( ) 1111 ripe.net. a3... if signed by the parents Zone-Signing-Key or DS or DNSKEY records can be trusted if exchanged outof-band and locally stored (Secure entry point) 9 page 59 Reflector attacks 21 September 2006 Stichting page 61 target src: resolver dst: target Answer from cache src: resolver dst: isp Recently Open recursive servers used to amplify traffic several Gbits/second traffic to critical infrastructure Source addresses at DDOS target are valid, packet format valid page 60 resolver DDOS and the DNS Scaling problem: secure islands Zone signing key, key signing key Chain of trust src: isp dst: resolver ISP page 63 an UDP problem Drop packets if source address is strange to the network src: target (spoof!) dst: resolver Remedy: Ingress filtering (BCP38) DNS has nice amplification characteristics closing open resolvers helps, but authoritative servers will do to You make the packets smaller? We ll just wake up more zombies Zombie botnet page 62 resolver page 57 Data in zone can be trusted if signed by a ZoneSigning-Key Zone-Signing-Keys can be trusted if signed by a KeySigning-Key Key-Signing-Key can be trusted if pointed to by trusted DS record DS record can be trusted ripe.net. DNSKEY ( ) rwx002 (4252) ; KSK DNSKEY ( ) sovp42 (1111) ; ZSK 8 RRSIG DNSKEY ( ) 4252 ripe.net. 5t... for DNSKEY & RRSIGs DNSKEY ( ) 5TQ3s (8907) ; KSK DNSKEY ( ) lase5 (2983) ; ZSK Chain of Trust Verification, page 56 Locally configured Trusted key: $ORIGIN. Zombie botnet 7

8 page 64 page 66 Repeat: BCP38 Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing Deploy on your own networks Act responsibly in the Public Space Require deployment by others Part of procurement procedures Key Rollovers Private Keys You have to keep your private key secret Private key can be stolen Put the key on stand alone machines or on bastion hosts behind firewalls and strong access control Private key reconstruction (crypto analysis) Random number not random Leakage of key material (DSA) Brute force attacks 21 September 2006 Stichting Key Rollovers Try to minimise impact Short validity of signatures Regular key rollover Remember: DNSKEYs do not have timestamps the RRSIG over the DNSKEY has the timestamp Key rollover involves second party or parties: State to be maintained during rollover Operationally expensive page 67 Timing of the Scheduled Key Rollover Don t remove the old key while there servers are still handing out the old DS RR New DS needs to be distributed to the slaves Max time set by the SOA expiration time Old DS needs to have expired from caches Set by the TTL of the original DS RR You (or your tool) can check if the master and slave have picked up the change page 68 time 0 t 1 t 2 t 3 Timing Properties Authoritative Master Authoritative Slave Caching Nameserver Foo TXT Old Foo TXT Old Foo TXT New Zone synchronization Foo TXT Old Foo TXT New TTL Poof page 69 Publication of new data Query to slave followed by Caching Zone transfer Expiration From Cache Unscheduled Rollover Problems Needs out of band communication With parent and pre-configured resolvers The parent needs to establish your identity again How to protect child delegations? Unsecured? There will be a period that the stolen key can be used to generate seemingly secure data There is no revoke key mechanism Emergency procedure must be on the shelf page 70 Key Rollover - Generate new KSK Sign with old and new KSKs Wait for your servers + TTL of old DNSKEY RRset Inform resolvers of the new key that have you as a trusted entry point Query for the parental DS and remember the TTL Upload the new KSK or DS to the parent Check if *all* parental servers have new DS Wait another TTL before removing the old key page 71 Key size and signature lifetimes Key rollovers Emergency procedure 21 September 2006 Stichting 8

9 page 73 9

DNS Risks, DNSSEC. Olaf M. Kolkman and Allison Mankin. olaf@nlnetlabs.nl and mankin@psg.com. http://www.nlnetlabs.nl/ 8 Feb 2006 Stichting NLnet Labs

DNS Risks, DNSSEC. Olaf M. Kolkman and Allison Mankin. olaf@nlnetlabs.nl and mankin@psg.com. http://www.nlnetlabs.nl/ 8 Feb 2006 Stichting NLnet Labs DNS Risks, DNSSEC Olaf M. Kolkman and Allison Mankin olaf@nlnetlabs.nl and mankin@psg.com 8 Feb 2006 Stichting NLnet Labs DNSSEC evangineers of the day Allison: Independent consultant Member of the Internet2

More information

DNSSEC Deployment a case study

DNSSEC Deployment a case study DNSSEC Deployment a case study Olaf M. Kolkman Olaf@NLnetLabs.nl RIPE NCCs Project Team: Katie Petrusha, Brett Carr, Cagri Coltekin, Adrian Bedford, Arno Meulenkamp, and Henk Uijterwaal Januari 17, 2006

More information

DNS at NLnet Labs. Matthijs Mekking

DNS at NLnet Labs. Matthijs Mekking DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the

More information

DNSSEC in your workflow

DNSSEC in your workflow DNSSEC in your workflow Presentation roadmap Overview of problem space Architectural changes to allow for DNSSEC deployment Deployment tasks Key maintenance DNS server infrastructure Providing secure delegations

More information

Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology

Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2

More information

XN--P1AI (РФ) DNSSEC Policy and Practice Statement

XN--P1AI (РФ) DNSSEC Policy and Practice Statement XN--P1AI (РФ) DNSSEC Policy and Practice Statement XN--P1AI (РФ) DNSSEC Policy and Practice Statement... 1 INTRODUCTION... 2 Overview... 2 Document name and identification... 2 Community and Applicability...

More information

DNSSEC. Introduction Principles Deployment

DNSSEC. Introduction Principles Deployment DNSSEC Introduction Principles Deployment Overview What we will cover The problems that DNSSEC addresses The protocol and implementations Things to take into account to deploy DNSSEC The practical problems

More information

DNSSEC Applying cryptography to the Domain Name System

DNSSEC Applying cryptography to the Domain Name System DNSSEC Applying cryptography to the Domain Name System Gijs van den Broek Graduate Intern at SURFnet Overview First half: Introduction to DNS Attacks on DNS Second half: DNSSEC Questions: please ask! DNSSEC

More information

The Domain Name System from a security point of view

The Domain Name System from a security point of view The Domain Name System from a security point of view Simon Boman Patrik Hellström Email: {simbo105, pathe321}@student.liu.se Supervisor: David Byers, {davby@ida.liu.se} Project Report for Information Security

More information

DNSSEC Policy and Practice Statement.amsterdam

DNSSEC Policy and Practice Statement.amsterdam DNSSEC Policy and Practice Statement.amsterdam Contact T +31 26 352 55 00 support@sidn.nl www.sidn.nl Offices Meander 501 6825 MD Arnhem Mailing address Postbus 5022 6802 EA Arnhem May 24, 2016 Public

More information

DNSSEC Policy & Practice Statement (DPS)

DNSSEC Policy & Practice Statement (DPS) Jakob-Haringer-Str. 8/V Tel.: +43 662 46 69-0 Fax: +43 662 46 69-19 5020 Salzburg, Austria E-Mail:service@nic.at Web: www.nic.at DNSSEC Policy & Practice Statement (DPS) for.at A: Bank Austria Creditanstalt

More information

DNSSEC Policy & Practice Statement for.tz Zone

DNSSEC Policy & Practice Statement for.tz Zone DNSSEC Policy & Practice Statement for.tz Zone Version 1.1 Effective Date: January 1, 2013 Tanzania Network Information Centre 14107 LAPF Millenium Towers, Ground Floor, Suite 04 New Bagamoyo Road, Dar

More information

American International Group, Inc. DNS Practice Statement for the AIG Zone. Version 0.2

American International Group, Inc. DNS Practice Statement for the AIG Zone. Version 0.2 American International Group, Inc. DNS Practice Statement for the AIG Zone Version 0.2 1 Table of contents 1 INTRODUCTION... 6 1.1 Overview...6 1.2 Document Name and Identification...6 1.3 Community and

More information

DNSSEC Briefing for GAC and ccnso

DNSSEC Briefing for GAC and ccnso DNSSEC Briefing for GAC and ccnso Steve Crocker Chair, SSAC October 30, 2007 Los Angeles, CA, USA 1 Topics Infrastructure Security Taxonomy DNSSEC walk through IANA Progress -- Richard Lamb Issues and

More information

Networking Domain Name System

Networking Domain Name System IBM i Networking Domain Name System Version 7.2 IBM i Networking Domain Name System Version 7.2 Note Before using this information and the product it supports, read the information in Notices on page

More information

This framework is documented under NLnet Labs copyright and is licensed under a Creative Commons Attribution 4.0 International License.

This framework is documented under NLnet Labs copyright and is licensed under a Creative Commons Attribution 4.0 International License. DNSSEC Infrastructure Audit Framework NLnet Labs Document 2013-002 Version 1.0 by Matthijs Mekking (matthijs@nlnetlabs.nl) and Olaf Kolkman (olaf@nlnetlabs.nl) This framework is documented under NLnet

More information

DNSSEC Practice Statement (DPS)

DNSSEC Practice Statement (DPS) DNSSEC Practice Statement (DPS) 1. Introduction This document, "DNSSEC Practice Statement ( the DPS ) for the zones under management of Zodiac Registry Limited, states ideas of policies and practices with

More information

CS 557 - Lecture 22 DNS Security

CS 557 - Lecture 22 DNS Security CS 557 - Lecture 22 DNS Security DNS Security Introduction and Requirements, RFC 4033, 2005 Fall 2013 The Domain Name System Virtually every application uses the Domain Name System (DNS). DNS database

More information

DNSSEC: A Vision. Anil Sagar. Additional Director Indian Computer Emergency Response Team (CERT-In)

DNSSEC: A Vision. Anil Sagar. Additional Director Indian Computer Emergency Response Team (CERT-In) DNSSEC: A Vision Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Outline DNS Today DNS Attacks DNSSEC: An Approach Countering DNS Attacks Conclusion 2 DNS Today DNS is

More information

Resilient Networking. Overview of DNS Known attacks on DNS Denial-of-Service Cache Poisoning. Securing DNS Split-Split-DNS DNSSEC.

Resilient Networking. Overview of DNS Known attacks on DNS Denial-of-Service Cache Poisoning. Securing DNS Split-Split-DNS DNSSEC. Resilient Networking 6: Attacks on DNS Overview of DNS Known attacks on DNS Denial-of-Service Cache Poisoning Securing DNS Split-Split-DNS DNSSEC SoSe 2014 Fachbereich Informatik Telecooperation Group

More information

An Introduction to the Domain Name System

An Introduction to the Domain Name System An Introduction to the Domain Name System Olaf Kolkman Olaf@nlnetlabs.nl October 28, 2005 Stichting NLnet Labs This Presentation An introduction to the DNS Laymen level For non-technologists About protocol

More information

DNSSEC Policy Statement Version 1.1.0. 1. Introduction. 1.1. Overview. 1.2. Document Name and Identification. 1.3. Community and Applicability

DNSSEC Policy Statement Version 1.1.0. 1. Introduction. 1.1. Overview. 1.2. Document Name and Identification. 1.3. Community and Applicability DNSSEC Policy Statement Version 1.1.0 This DNSSEC Practice Statement (DPS) conforms to the template included in RFC 6841. 1. Introduction The approach described here is modelled closely on the corresponding

More information

DNSSEC - SECURE DNS FOR GOVERNMENT. Whitepaper

DNSSEC - SECURE DNS FOR GOVERNMENT. Whitepaper DNSSEC - SECURE DNS FOR GOVERNMENT Whitepaper ii BlueCat Networks Use of this document Copyright This document and all information (in text, Graphical User Interface ( GUI ), video and audio forms), images,

More information

DNSSEC. Introduction. Domain Name System Security Extensions. AFNIC s Issue Papers. 1 - Organisation and operation of the DNS

DNSSEC. Introduction. Domain Name System Security Extensions. AFNIC s Issue Papers. 1 - Organisation and operation of the DNS AFNIC s Issue Papers DNSSEC Domain Name System Security Extensions 1 - Organisation and operation of the DNS 2 - Cache poisoning attacks 3 - What DNSSEC can do 4 - What DNSSEC cannot do 5 - Using keys

More information

Where is Hong Kong in the secure Internet infrastructure development. Warren Kwok, CISSP Internet Society Hong Kong 12 August 2011

Where is Hong Kong in the secure Internet infrastructure development. Warren Kwok, CISSP Internet Society Hong Kong 12 August 2011 The Internet is for Everyone. Become an ISOC Member. Cyber Security Symposium 2011 Where is Hong Kong in the secure Internet infrastructure development Warren Kwok, CISSP Internet Society Hong Kong 12

More information

USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION

USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION Transaction Signatures (TSIG) provide a secure method for communicating in the Domain Name System (DNS) from a primary to a secondary

More information

DNS. Some advanced topics. Karst Koymans. (with Niels Sijm) Informatics Institute University of Amsterdam. (version 2.6, 2013/09/19 10:55:30)

DNS. Some advanced topics. Karst Koymans. (with Niels Sijm) Informatics Institute University of Amsterdam. (version 2.6, 2013/09/19 10:55:30) DNS Some advanced topics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.6, 2013/09/19 10:55:30) Friday, September 13, 2013 Karst Koymans (with Niels Sijm) (UvA)

More information

WHITE PAPER. Best Practices DNSSEC Zone Management on the Infoblox Grid

WHITE PAPER. Best Practices DNSSEC Zone Management on the Infoblox Grid WHITE PAPER Best Practices DNSSEC Zone Management on the Infoblox Grid What Is DNSSEC, and What Problem Does It Solve? DNSSEC is a suite of Request for Comments (RFC) compliant specifications developed

More information

Securing DNS Infrastructure Using DNSSEC

Securing DNS Infrastructure Using DNSSEC Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias rmohan@afilias.info February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival

More information

DNS security: poisoning, attacks and mitigation

DNS security: poisoning, attacks and mitigation DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain

More information

Computer Networks: Domain Name System

Computer Networks: Domain Name System Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com

More information

DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers

DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers version 1.9., valid since 1 January 2010 Introduction This material lays out operational rules that govern the work of the CZ.NIC association

More information

KSRegistry DNSSEC Policy Statement

KSRegistry DNSSEC Policy Statement KSRegistry DNSSEC Policy Statement 1. INTRODUCTION...5 1.1 Overview...5 1.2 Document name and identification...5 1.3. Community and Applicability...5 1.3.1 Registry...5 1.3.2 Registrars...5 1.3.3 Registrants...6

More information

Authenticated Denial of Existence in the DNS

Authenticated Denial of Existence in the DNS CC BY-SA 3.0 SIDN Labs 2011/0x01-v2 Authenticated Denial of Existence in the DNS Miek Gieben, miek.gieben@sidn.nl, SIDN Matthijs Mekking, matthijs@nlnetlabs.nl, NLnet Labs January 2012 Abstract Authenticated

More information

Good practices guide for deploying DNSSEC

Good practices guide for deploying DNSSEC Deploying DNSSEC January 10 Good practices guide Good practices guide for deploying DNSSEC About ENISA: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the

More information

Table of Contents DNS. How to package DNS messages. Wire? DNS on the wire. Some advanced topics. Encoding of domain names.

Table of Contents DNS. How to package DNS messages. Wire? DNS on the wire. Some advanced topics. Encoding of domain names. Table of Contents DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 154, 2015/09/14 10:44:10) Friday, September 11, 2015 DNS on the wire Encoding of domain names

More information

Internet-Praktikum I Lab 3: DNS

Internet-Praktikum I Lab 3: DNS Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans

More information

DNSSEC and DNS Proxying

DNSSEC and DNS Proxying DNSSEC and DNS Proxying DNS is hard at scale when you are a huge target 2 CloudFlare DNS is big 3 CloudFlare DNS is fast 4 CloudFlare DNS is always under attack 5 CloudFlare A secure reverse proxy for

More information

Security of IPv6 and DNSSEC for penetration testers

Security of IPv6 and DNSSEC for penetration testers Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions

More information

A Security Evaluation of DNSSEC with NSEC3

A Security Evaluation of DNSSEC with NSEC3 A Security Evaluation of DNSSEC with NSEC3 Jason Bau Stanford University Stanford, CA, USA jbau@stanford.edu Abstract Domain Name System Security Extensions (DNSSEC) with Hashed Authenticated Denial of

More information

Step-by-Step DNSSEC-Tools Operator Guidance Document

Step-by-Step DNSSEC-Tools Operator Guidance Document Step-by-Step DNSSEC-Tools Operator Guidance Document Using the DNSSEC-Tools v1.0 distribution SPARTA, Inc. Table of Contents 1. Introduction... 1 Organization of this Document... 1 Key Concepts... 2 Zones

More information

Secure Domain Name System (DNS) Deployment Guide

Secure Domain Name System (DNS) Deployment Guide NIST Special Publication 800-81-2 Secure Domain Name System (DNS) Deployment Guide Ramaswamy Chandramouli Scott Rose C O M P U T E R S E C U R I T Y NIST Special Publication 800-81-2 Secure Domain Name

More information

page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl http://www.nlnetlabs.nl/ 28 Feb 2013 Stichting NLnet Labs

page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl http://www.nlnetlabs.nl/ 28 Feb 2013 Stichting NLnet Labs page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl page 2 One slide DNS Root www.nlnetlabs.nl A Referral: nl NS www.nlnetlabs.nl A 213.154.224.1 www.nlnetlabs.nl A www.nlnetlabs.nl A 213.154.224.1

More information

DRDoS Attacks: Latest Threats and Countermeasures. Larry J. Blunk Spring 2014 MJTS 4/1/2014

DRDoS Attacks: Latest Threats and Countermeasures. Larry J. Blunk Spring 2014 MJTS 4/1/2014 DRDoS Attacks: Latest Threats and Countermeasures Larry J. Blunk Spring 2014 MJTS 4/1/2014 Outline Evolution and history of DDoS attacks Overview of DRDoS attacks Ongoing DNS based attacks Recent NTP monlist

More information

DNSSEC Root Zone. High Level Technical Architecture

DNSSEC Root Zone. High Level Technical Architecture DNSSEC Root Zone Prepared by the Root DNSSEC Design Team Joe Abley David Blacka David Conrad Richard Lamb Matt Larson Fredrik Ljunggren David Knight Tomofumi Okubo Jakob Schlyter Version 1.2.1 October

More information

Defending your DNS in a post-kaminsky world. Paul Wouters

Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com> Defending your DNS in a post-kaminsky world Paul Wouters Vendor and NGO's involved Two phase deployment First release a generic fix for the Kaminsky attack that does not leak information

More information

Deploying DNSSEC: From End-Customer To Content

Deploying DNSSEC: From End-Customer To Content Deploying DNSSEC: From End-Customer To Content March 28, 2013 www.internetsociety.org Our Panel Moderator: Dan York, Senior Content Strategist, Internet Society Panelists: Sanjeev Gupta, Principal Technical

More information

GDS Resource Record: Generalization of the Delegation Signer Model

GDS Resource Record: Generalization of the Delegation Signer Model GDS Resource Record: Generalization of the Delegation Signer Model Gilles Guette, Bernard Cousin, David Fort To cite this version: Gilles Guette, Bernard Cousin, David Fort. GDS Resource Record: Generalization

More information

DNSSEC Root Zone. High Level Technical Architecture

DNSSEC Root Zone. High Level Technical Architecture DNSSEC Root Zone Prepared by the Root DNSSEC Design Team Joe Abley David Blacka David Conrad Richard Lamb Matt Larson Fredrik Ljunggren David Knight Tomofumi Okubo Jakob Schlyter Version 1.4 June 7, 2010

More information

Secure Domain Name System (DNS) Deployment Guide

Secure Domain Name System (DNS) Deployment Guide Special Publication 800-81 Sponsored by the Department of Homeland Security Secure Domain Name System (DNS) Deployment Guide Recommendations of the National Institute of Standards and Technology Ramaswamy

More information

DNSSEC. Key Maintenance Analysis. by Jelte Jansen

DNSSEC. Key Maintenance Analysis. by Jelte Jansen DNSSEC Key Maintenance Analysis by Jelte Jansen DNSSEC Key Maintenance Analysis Jelte Jansen, NLnet Labs http://www.nlnetlabs.nl NLnet Labs document 2008-002 version 1.0 September 11, 2008 jelte@nlnetlabs.nl

More information

Lecture 2 CS 3311. An example of a middleware service: DNS Domain Name System

Lecture 2 CS 3311. An example of a middleware service: DNS Domain Name System Lecture 2 CS 3311 An example of a middleware service: DNS Domain Name System The problem Networked computers have names and IP addresses. Applications use names; IP uses for routing purposes IP addresses.

More information

DOMAIN NAME SECURITY EXTENSIONS

DOMAIN NAME SECURITY EXTENSIONS DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions

More information

DNSSEC: The Antidote to DNS Cache Poisoning and Other DNS Attacks

DNSSEC: The Antidote to DNS Cache Poisoning and Other DNS Attacks F5 Technical Brief DNSSEC: The Antidote to DNS Cache Poisoning and Other DNS Attacks Domain Name System (DNS) provides one of the most basic but critical functions on the Internet. If DNS isn t working,

More information

Domain Name System (DNS) Security By Diane Davidowicz 1999 Diane Davidowicz

Domain Name System (DNS) Security By Diane Davidowicz 1999 Diane Davidowicz Domain Name System (DNS) Security By Diane Davidowicz 1999 Diane Davidowicz Contents 1. Abstract...3 2. Introduction...3 3. Overview of the DNS...3 3.1. Fundamentals of DNS...4 3.1.1. The Domain Name Space...4

More information

Defending against DNS reflection amplification attacks

Defending against DNS reflection amplification attacks University of Amsterdam System & Network Engineering RP1 Defending against DNS reflection amplification attacks February 14, 2013 Authors: Thijs Rozekrans Javy de Koning

More information

Domain Name System Security

Domain Name System Security Abstract Domain Name System Security Ladislav Hagara hgr@vabo.cz Department of Automated Command Systems and Informatics Military Academy in Brno Brno, Czech Republic Domain Name System (DNS) is one of

More information

DNS Security: New Threats, Immediate Responses, Long Term Outlook. 2007 2008 Infoblox Inc. All Rights Reserved.

DNS Security: New Threats, Immediate Responses, Long Term Outlook. 2007 2008 Infoblox Inc. All Rights Reserved. DNS Security: New Threats, Immediate Responses, Long Term Outlook 2007 2008 Infoblox Inc. All Rights Reserved. A Brief History of the Recent DNS Vulnerability Kaminsky briefs key stakeholders (CERT, ISC,

More information

Domain Name System (DNS) Fundamentals

Domain Name System (DNS) Fundamentals Domain Name System (DNS) Fundamentals Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International

More information

DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment

DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment Dan York, CISSP Senior Content Strategist, Internet Society Eurasia Network Operators' Group (ENOG) 4 Moscow, Russia October

More information

Use Domain Name System and IP Version 6

Use Domain Name System and IP Version 6 Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)

More information

Verisign DNSSEC Practice Statement for EDU Zone

Verisign DNSSEC Practice Statement for EDU Zone Verisign DNSSEC Practice Statement for EDU Zone Version 1.4 Effective Date: November 11, 2013 Abstract This document is the DNSSEC Practice Statement for the EDU Zone. It states the practices and provisions

More information

Prepared by: National Institute of Standards and Technology SPARTA, Inc. Shinkuro, Inc.

Prepared by: National Institute of Standards and Technology SPARTA, Inc. Shinkuro, Inc. Signing the Domain Name System Root Zone: Technical Specification Prepared for: Science and Technology Directorate US Department of Homeland Security Prepared by: National Institute of Standards and Technology

More information

DNS Security FAQ for Registrants

DNS Security FAQ for Registrants DNS Security FAQ for Registrants DNSSEC has been developed to provide authentication and integrity to the Domain Name System (DNS). The introduction of DNSSEC to.nz will improve the security posture of

More information

Reverse DNS considerations for IPv6

Reverse DNS considerations for IPv6 Reverse DNS considerations for IPv6 Kostas Zorbadelos OTE David Freedman - ClaraNet Reverse DNS in IPv4 Every Internet-reachable host should have a name Make sure your PTR and A records match. For every

More information

DNS/DNSSEC loose ends

DNS/DNSSEC loose ends DNS/DNSSEC loose ends Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Friday, September 21, 2012 Karst Koymans & Niels Sijm (UvA) DNS/DNSSEC loose ends Friday, September 21, 2012

More information

Securing an Internet Name Server

Securing an Internet Name Server Securing an Internet Name Server Cricket Liu cricket@verisign.com Securing an Internet Name Server Name servers exposed to the Internet are subject to a wide variety of attacks: Attacks against the name

More information

Security vulnerabilities in DNS and DNSSEC

Security vulnerabilities in DNS and DNSSEC Security vulnerabilities in DNS and DNSSEC Suranjith Ariyapperuma and Chris J. Mitchell Information Security Group Royal Holloway, University of London Egham, Surrey TW20 0EX, UK Email: suranjith.ariyapperuma@anglia.ac.uk,

More information

TLS and SRTP for Skype Connect. Technical Datasheet

TLS and SRTP for Skype Connect. Technical Datasheet TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security

More information

Some advanced topics. Karst Koymans. Friday, September 11, 2015

Some advanced topics. Karst Koymans. Friday, September 11, 2015 DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 154, 2015/09/14 10:44:10) Friday, September 11, 2015 Karst Koymans (UvA) DNS Friday, September 11, 2015 1 /

More information

DNSSEC for Everybody: A Beginner s Guide

DNSSEC for Everybody: A Beginner s Guide DNSSEC for Everybody: A Beginner s Guide San Francisco, California 14 March 2011 4:00 to 5:00 p.m. Colonial Room The Schedule 2 This is Ugwina. She lives in a cave on the edge of the Grand Canyon... This

More information

EDU DNSSEC Testbed. Shumon Huque, University of Pennsylvania Larry Blunk, MERIT Network

EDU DNSSEC Testbed. Shumon Huque, University of Pennsylvania Larry Blunk, MERIT Network EDU DNSSEC Testbed Shumon Huque, University of Pennsylvania Larry Blunk, MERIT Network Internet2 Joint Techs Conference Salt Lake City, Utah February 2nd 2010 1 DNSSEC DNS Security Extensions A system

More information

A Step-by-Step guide for implementing DANE with a Proof of Concept

A Step-by-Step guide for implementing DANE with a Proof of Concept A Step-by-Step guide for implementing DANE with a Proof of Concept Sandoche BALAKRICHENAN, Stephane BORTZMEYER, Mohsen SOUISSI AFNIC R&D {sandoche.balakrichenan, stephane.bortzmeyer, mohsen.souissi}@afnic.fr

More information

Reliable Strong Cache and Security for the Domain Name System

Reliable Strong Cache and Security for the Domain Name System Reliable Strong Cache and Security for the Domain Name System S. Pari Elavarasan #1, K. Sampath Kumar *2 # Department of Computer Science and Engineering, PGP College of Engineering and Technology, Namakkal,

More information

The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. Duisburg, June 19, 2015

The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. <matthaeus.wander@uni-due.de> Duisburg, June 19, 2015 The Impact of DNSSEC on the Internet Landscape Matthäus Wander Duisburg, June 19, 2015 Outline Domain Name System Security problems Attacks in practice DNS Security Extensions

More information

Server Certificates based on DNSSEC

Server Certificates based on DNSSEC Server Certificates based on DNSSEC Audun Jøsang and Kashif Sana Dar University of Oslo josang@mn.uio.no and kashifd@ifi.uio.no Abstract. Globally unique domain names and IP addresses that are provided

More information

DNSSEC Practice Statement

DNSSEC Practice Statement DNSSEC Practice Statement 31 October 2014 Head Office Melbourne, Australia p +61 3 9866 3710 f +61 3 9866 1970 ABN 16 103 729 620 ACN 103 729 620 US Office Los Angeles, United States p +1 213 330 4203

More information

Surviving a DDoS Attack:

Surviving a DDoS Attack: Surviving a DDoS Attack: What every host needs to know Maria Karaivanova, Business Development David Koston, Platform www.cloudflare.com DDoS Attacks are becoming massive, and easier to initiate!2 Major

More information

The Internet Domain Name System Explained for Non- Experts

The Internet Domain Name System Explained for Non- Experts The Internet Domain Name System Explained for Non- Experts Internet Society Member Briefing #16 By Daniel Karrenberg The Internet Domain Name System Explained for Non-Experts Dear non-experts, This is

More information

DNS and BIND. David White

DNS and BIND. David White DNS and BIND David White DNS: Backbone of the Internet Translates Domains into unique IP Addresses i.e. developcents.com = 66.228.59.103 Distributed Database of Host Information Works seamlessly behind

More information

Networking Domain Name System

Networking Domain Name System System i Networking Domain Name System Version 5 Release 4 System i Networking Domain Name System Version 5 Release 4 Note Before using this information and the product it supports, read the information

More information

Domain Name System (DNS) Session-1: Fundamentals. Ayitey Bulley abulley@ghana.com

Domain Name System (DNS) Session-1: Fundamentals. Ayitey Bulley abulley@ghana.com Domain Name System (DNS) Session-1: Fundamentals Ayitey Bulley abulley@ghana.com Computers use IP addresses. Why do we need names? Names are easier for people to remember Computers may be moved between

More information

Defending your DNS in a post-kaminsky world. Paul Wouters

Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com> Defending your DNS in a post-kaminsky world Paul Wouters Overview History of DNS and the Kaminsky attack Various DNS problems explained Where to address the DNS problem Nameservers,

More information

Overview of DNSSEC deployment worldwide

Overview of DNSSEC deployment worldwide The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research conducted by EURid in cooperation with industry experts

More information

Current Counter-measures and Responses by the Domain Name System Community

Current Counter-measures and Responses by the Domain Name System Community Current Counter-measures and Responses by the Domain Name System Community Paul Twomey President and CEO 22 April 2007 APEC-OECD Malware Workshop Manila, The Philippines 1 What I want to do today in 15

More information

Network Infrastructure Under Siege

Network Infrastructure Under Siege Network Infrastructure Under Siege Char Sample Security Engineer, CERT Information Security Decisions TechTarget Disclaimer Standard Disclaimer - This talk represents the opinions and research of the presenter

More information

Sync Security and Privacy Brief

Sync Security and Privacy Brief Introduction Security and privacy are two of the leading issues for users when transferring important files. Keeping data on-premises makes business and IT leaders feel more secure, but comes with technical

More information

Response Policy Zones for the Domain Name System (DNS RPZ) By Paul Vixie, ISC (et.al.) 2010 World Tour

Response Policy Zones for the Domain Name System (DNS RPZ) By Paul Vixie, ISC (et.al.) 2010 World Tour Response Policy Zones for the Domain Name System (DNS ) By Paul Vixie, ISC (et.al.) 2010 World Tour Overview Motivation for DNS Response Policy Zones Relationship to DNS RBL (DNSBL) Constraints and Goals

More information

DNSSEC Misconfigurations: How incorrectly configured security leads to unreachability

DNSSEC Misconfigurations: How incorrectly configured security leads to unreachability DNSSEC Misconfigurations: How incorrectly configured security leads to unreachability Niels L. M. van Adrichem, Antonio Reyes Lúa, Xin Wang, Muhammad Wasif, Ficky Fatturrahman and Fernando A. Kuipers Network

More information

The Myth of Twelve More Bytes. Security on the Post- Scarcity Internet

The Myth of Twelve More Bytes. Security on the Post- Scarcity Internet The Myth of Twelve More Bytes Security on the Post- Scarcity Internet IPv6 The Myth of 12 More Bytes HTTP DHCP HTTP TLS ARP TCP UDP Internet Protocol Link Layer Physical Layer ICMP The Myth of 12 More

More information

DNS SECURITY TROUBLESHOOTING GUIDE

DNS SECURITY TROUBLESHOOTING GUIDE DNS SECURITY TROUBLESHOOTING GUIDE INTERNET DEPLOYMENT OF DNS SECURITY 27 November 2006 Table of Contents 1. INTRODUCTION...3 2. DNS SECURITY SPECIFIC FAILURE MODES...3 2.1 SIGNATURES...3 2.1.1 Signature

More information

Domain Name System. CS 571 Fall 2006. 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved

Domain Name System. CS 571 Fall 2006. 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved Domain Name System CS 571 Fall 2006 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved DNS Specifications Domain Names Concepts and Facilities RFC 1034, November 1987 Introduction

More information

THE DOMAIN NAME SYSTEM DNS

THE DOMAIN NAME SYSTEM DNS Announcements THE DOMAIN NAME SYSTEM DNS Internet Protocols CSC / ECE 573 Fall, 2005 N. C. State University copyright 2005 Douglas S. Reeves 2 Today s Lecture I. Names vs. Addresses II. III. IV. The Namespace

More information

DOMAIN NAME SYSTEM (DNS)

DOMAIN NAME SYSTEM (DNS) CPNI viewpoint 01/2008 DOMAIN NAME SYSTEM (DNS) may 2008 Abstract This Viewpoint considers some of the security considerations of the Domain Name System and makes some observations regarding how organisations

More information

dnsperf DNS Performance Tool Manual

dnsperf DNS Performance Tool Manual dnsperf DNS Performance Tool Manual Version 2.0.0 Date February 14, 2012 Copyright 2002-2012, Inc. - All Rights Reserved This software and documentation is subject to and made available pursuant to the

More information

Managing and Securing Computer Networks. Guy Leduc. Chapter 3: Securing applications. Chapter goals: security in practice:

Managing and Securing Computer Networks. Guy Leduc. Chapter 3: Securing applications. Chapter goals: security in practice: Managing and Securing Computer Networks Guy Leduc Chapter 3: Securing applications Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section 8.5)

More information

SIDN Server Measurements

SIDN Server Measurements SIDN Server Measurements Yuri Schaeffer 1, NLnet Labs NLnet Labs document 2010-003 July 19, 2010 1 Introduction For future capacity planning SIDN would like to have an insight on the required resources

More information

Conexim DNS Administrator s Guide

Conexim DNS Administrator s Guide Conexim DNS Administrator s Guide Last Updated August 2013 Contents Conexim DNS Quick Reference... 1 DNS Delegation Information... 1 Control Panel Access... 1 Supported Record Types... 1 Getting Support...

More information