Securing Your Business with DNS Servers That Protect Themselves

Transcription

1 Product Summary: The Infoblox Secure DNS Solution mitigates attacks on DNS servers by intelligently recognizing various attack types and dropping attack traffic while responding only to legitimate queries. It also prevents the theft of customer and business data by disrupting advanced persistent threats (APTs) and malware that use DNS to communicate with malicious domains. By combining Infoblox Advanced DNS Protection and Infoblox DNS Firewall with an underlying secure platform and with Infoblox DNS Firewall FireEye Adapter, the solution delivers comprehensive protection against denial-of-service attacks that target DNS and against APT-based attacks that try to exfiltrate data from within. Built-in Protection for Your DNS Infrastructure If your external Domain Name System (DNS) server goes down, your entire network is shut off from the Internet, so your business depends on having DNS servers that continue to respond to queries even when they are under attack. Neustar s annual DDoS report for 014 estimates an average financial damage of $100,000 per hour of outage. Companies that experience extended service disruptions lose revenue, customers, and brand value. Unfortunately the DNS protocol and the open-source software and commodity servers most organizations use to manage DNS services have easily exploited vulnerabilities that defenses such as next-generation firewalls, secure web gateways, and incident detection and prevention systems do little to protect against. The only sure method of securing DNS servers is to build protection into the servers themselves. As the leader in DNS, Infoblox has embraced this self-protecting server approach to deliver the most effective solution on the market for protecting your mission-critical DNS services from attack. The Increasing Exploitation of DNS Vulnerability In Arbor Networks latest Worldwide Infrastructure Security Survey, over half (57 percent) of respondents said they had been hit with a DNS attack. Within the many attack vectors being exploited today, the survey revealed DNS as third. Targets of Application-Layer Attacks Survey Respondents 90% 80% 70% 60% 50% 40% 30% 0% 10% 0% 81% HTTP 58% HTTPS 57% DNS 1% 17% SIP/VoIP 9% Other 015 Infoblox Inc. All Rights Reserved. infoblox-solution note- -Feb015 1

2 Fighting a Battle on Two Fronts There are two basic kinds of DNS threat vectors attacks on the DNS infrastructure, and APTs and malware that use DNS as a communication path. To protect against the loss of trust, possible lawsuits, remediation costs, compliance penalties, and diminished revenue a successful attack can cause, you need to protect DNS servers from both outside-in and inside-out threats. To mitigate attacks on external authoritative servers, the servers themselves need to intelligently recognize various attack types and drop the attack traffic without disrupting legitimate queries. To detect DNS attacks that affect recursive servers inside the network and cause significant disruption like cache and resource exhaustion and outbound bandwidth congestion, the recursive servers must be able to identify and drop these attacks as well as block traffic to misbehaving domains and servers that are usually set up as part of these attacks. To avoid the theft of customer data and business assets, your servers need to automatically block endpoints/devices within the network from communicating to malicious domains via DNS. With DNS servers that can accomplish these functions, you can detect DNS DDoS attacks and keep your business processes running while you fight them. And if APTs and malware find their way past your firewall, you can keep them from exploiting DNS as a channel to send customer data and company assets off the network to criminals who hope to profit at your expense. At Infoblox we are well aware that to protect against DNS-based attacks, you must fight a two-front war. Based on this knowledge and on our extensive experience helping our customers around the world manage and secure DNS services we offer a complete solution that protects you on both fronts. The Infoblox Secure DNS Solution The Secure DNS Solution consists of Infoblox Advanced DNS Protection, which shields networks from attacks; Infoblox DNS Firewall, which blocks APT and malware communication from within the network; and the DNS Firewall FireEye Adapter, which leverages APT protection from Infoblox partner, FireEye. Running on purpose-built DNS appliances, these solutions effectively protect both your external and internal DNS infrastructure. Unlike the products of other DNS vendors, our solution has intelligent detection and mitigation built in to automatically address DNS attacks and DNS queries to malicious destinations. In addition, it leverages continual, automatic updates to protect against new and evolving attacks and emerging malicious domains and networks. Infoblox is the first and only vendor to offer this level of security using DNS appliances. 015 Infoblox Inc. All Rights Reserved. infoblox-solution note- -Feb015

3 Protection from the Platform Up Protection starts with the hardware Infoblox purpose-built appliances hardened for security during the manufacturing process and certified for Common Criteria Level EAL-. One-click enablement and automatic key refresh eliminate the usual complexity of implementing DNS Security (DNSSEC). Guarding against Attacks Infoblox Advanced DNS Protection provides defense against the widest range of DNS-based attacks such as volumetric attacks, exploits, and DNS hijacking attacks. This provides secure, highly available, and trustworthy DNS services even when your network is under attack. Advanced DNS Protection uses Infoblox Threat Adapt technology to keep the protection updated automatically against new and evolving threats as they emerge. Through comprehensive reports, the solution gives you a centralized view of attacks that have happened on your network and provides the intelligence you need to take action. These reports include details like number of events by category, rule, severity, member-trend analysis, and time-based analysis. Since every enterprise has different DNS traffic-flow patterns that can vary based on seasonality, time of day, or geography, Infoblox Advanced DNS Protection provides tunable traffic thresholds that you set, enabling you to fine-tune protection parameters based on your unique traffic patterns. Advanced DNS Protection is fast and easy to get up and running. Once installed, it starts blocking attacks immediately even if an attack is already in progress. Floods DNS Exploits Reconnaissance Amplification Infoblox Advanced DNS Protection (External DNS) Infoblox Threat Rule Server Automatic Updates (Threat Adapt) Grid Master Grid-wide rule distribution Data for Reports Grid-wide rule distribution Infoblox Advanced DNS Protection Reporting Server Figure 1: Infoblox Advanced DNS Protection provides unique protection against DNS-based attacks. 015 Infoblox Inc. All Rights Reserved. infoblox-solution note- -Feb015 3

4 Guarding against APTs, Malware, and Data Exfiltration The Infoblox DNS Firewall protects against APT-driven and malware-driven DNS-queries to malicious domains by disrupting the ability of infected devices to communicate with botnets or command-and-control servers. DNS Firewall uses threat intelligence derived from internal and external sources. Infoblox provides threat intelligence on known malicious domains, IP addresses, and networks via a threat-update service that derives data from 39+ feed sources, both public and proprietary. We use our own custom algorithms to identify currently bad domains, IP addresses, and networks, broken down by the kind of threat they present. In addition, DNS Firewall uses external threat intelligence, including from the FireEye NX series of APT detection software. The integration combines the power of FireEye APT detection and Infoblox DNS-level blocking and device fingerprinting to help your network team detect and disrupt APT malware communication and to pinpoint infected devices attempting to access malicious domains. Malicious domains Infoblox Threat Intelligence via threat-update service Domains, IP addresses to be blocked Internet Internet 3 DNS Firewall blocks communication of infected device to malicious domain. DMZ Infoblox DDI with DNS Firewall Intranet Intranet Domains, IP addresses to be blocked Other Threat Intelligence (e.g. FireEye) Malware makes a DNS query to find home (C&C site/botnet). 1 4 Infected Device Logging: DNS Firewall sends the query to malicious domain to Syslog server. Infoblox Reporting Server: Reports on infected devices by MAC/IP address and device type. Figure : Infoblox DNS Firewall provides comprehensive protection against APTs and malware that use DNS to reach out to malicious domains. 015 Infoblox Inc. All Rights Reserved. infoblox-solution note- -Feb015 4

5 As shown in Figure : 1. An infected device is connected to the corporate network. Malware makes a DNS query to find home, a botnet or command-and-control (C&C) server.. Utilizing threat intelligence based on Infoblox threat-update service and other intelligence such as from FireEye NX Series input, DNS Firewall receives comprehensive, accurate, and current data on rapidly evolving domains and networks. Infoblox s threat-update service takes place every two hours (or more often for a significant threat). 3. The DNS Firewall looks at the DNS response, and checks the domain against the threat intelligence it has on malicious domains. If there is a match, the DNS Firewall takes an administrator-defined action (disallows communication to malware site or redirects traffic to a landing page or walled garden site). The DNS Firewall essentially prevents devices from going to a malware-infected website, and hijacked DNS command-and-control requests are not executed, preventing botnets from operating. 4. All inappropriate connection attempts are logged and correlated to help pinpoint infected devices. Infoblox Reporting lists the DNS Firewall action as well as the: Device IP address Device MAC address Device type (DHCP fingerprint) Device host name Device lease history Don t Become the Next Highly Publicized Victim. The impact of DNS-based attacks is apparent to anyone who follows IT-related news on line. In January of 014, a large portion of Internet traffic in China was redirected by hackers. In March, American Express discovered a data breach that exposed names and account numbers for roughly 76,000 customers. JPMorgan Chase revealed that customer data had been exposed in a large-scale attack that targeted major financial institutions. In August, Sony s PlayStation Network experienced an outage for at least some hours after a DDoS attack left the network inaccessible to users. And, in late 014, the U.S. Postal Service announced that it fell victim to a cyber intrusion incident and was working with the Federal Bureau of Investigation (FBI) to learn more about the attack. All of these attacks were publicized over multiple news outlets for several days. Can your business afford the downtime, customer ire, lost revenue, and bad publicity that goes with this kind of disruption? If not, then contact us today to find out more about how you can defend against the most dangerous threats your network faces. About Infoblox Infoblox (NYSE:BLOX), headquartered in Santa Clara, California, delivers network control solutions, the fundamental technology that connects end users, devices, and networks. These solutions enable more than 7,000 enterprises and service providers around the world to transform, secure, and scale complex networks. Infoblox ( helps take the burden of complex network control out of human hands, reduce costs, and increase security, accuracy, and uptime. Corporate Headquarters: (toll-free, U.S. and Canada) info@infoblox.com Infoblox Inc. All Rights Reserved. infoblox-solution note- -Feb015 5