Deploying DNSSEC: From End-Customer To Content
|
|
|
- Harold Lawson
- 10 years ago
- Views:
Transcription
1 Deploying DNSSEC: From End-Customer To Content March 28,
2 Our Panel Moderator: Dan York, Senior Content Strategist, Internet Society Panelists: Sanjeev Gupta, Principal Technical Architect, DCS1 Pte Jitender Kumar, Technical Account Manager, Afilias Richard Lamb, DNSSEC Program Manager, ICANN
3 A Quick Introduction to DNS and DNSSEC
4 What Problem Is DNSSEC Trying To Solve? DNSSEC = "DNS Security Extensions" Defined in RFCs 4033, 4034, 4035 Operational Practices: RFC 4641 Ensures that the information entered into DNS by the domain name holder is the SAME information retrieved from DNS by an end user. Let's walk through an example to explain
5 A Normal DNS Interaction Server 3 example.com? 1 DNS Resolver Resolver checks its local cache. If it has the answer, it sends it back. example.com If not web page Browser
6 A Normal DNS Interaction.com NS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS example.com 6 web page Browser
7 DNS Works On Speed First result received by a DNS resolver is treated as the correct answer. Opportunity is there for an attacker to be the first one to get an answer to the DNS resolver, either by: Getting to the correct point in the network to provide faster responses; Blocking the responses from the legitimate servers (ex. executing a Denial of Service attack against the legitimate servers to slow their responses)
8 Attacking DNS.com NS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS example.com web page Browser Attacking example.com
9 A Poisoned Cache Server 3 example.com? 1 DNS Resolver Resolver cache now has wrong data: example.com web page Browser This stays in the cache until the Time-To-Live (TTL) expires!
10 How Does DNSSEC Help? DNSSEC introduces new DNS records for a domain: RRSIG a signature ("hash") of a set of DNS records DNSKEY a public key that a resolver can use to validate RRSIG A DNSSEC-validating DNS resolver: Uses DNSKEY to perform a hash calculation on received DNS records Compares result with RRSIG records. If results match, records are the same as those transmitted. If the results do NOT match, they were potentially changed during the travel from the DNS server.
11 A DNSSEC Interaction root.com Server 5 example.com? 1 DNS Resolver 2 example.com 6 web page Browser DNSKEY RRSIGs
12 But Can DNSSEC Be Spoofed? But why can't an attacker simply insert DNSKEY and RRSIG records? What prevents DNSSEC from being spoofed? An additional was introduced, the "Delegation Signer (DS)" record It is a fingerprint of the DNSKEY record that is sent to the TLD registry Provides a global "chain of trust" from the root of DNS down to the domain Attackers would have to compromise the registry
13 A DNSSEC Interaction.com NS DS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS DS example.com 6 web page Browser DNSKEY RRSIGs
14 The Global Chain of Trust.com NS DS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS DS example.com 6 web page Browser DNSKEY RRSIGs
15 Attempting to Spoof DNS.com NS DS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS DS example.com 6 web page Browser DNSKEY RRSIGs DNSKEY RRSIGs Attacking example.com
16 Attempting to Spoof DNS.com NS DS root.com Server 5 example.com? 1 DNS Resolver 2 example.com NS DS example.com 6 web page Browser 4 SERVFAIL DNSKEY RRSIGs DNSKEY RRSIGs Attacking example.com
17 What DNSSEC Proves: "These ARE the IP addresses you are looking for." (or they are not) Ensures that information entered into DNS by the domain name holder (or the operator of the DNS hosting service for the domain) is the SAME information that is received by the end user.
18 The Two Parts of DNSSEC Signing Validating Registries Applications Registrars Enterprises DNS Hosting ISPs
19 DNSSEC and SSL
20 Why Do I Need DNSSEC If I Have SSL? A common question: why do I need DNSSEC if I already have a SSL certificate? (or an "EV-SSL" certificate?) SSL (more formerly known today as Transport Layer Security (TLS)) solves a different issue it provides encryption and protection of the communication between the browser and the web server
21 The Typical TLS (SSL) Interaction root Server.com example.com TLS-encrypted web page 2 example.com? 1 DNS Resolver Browser
22 The Typical TLS (SSL) Interaction root Server.com example.com TLS-encrypted web page 2 example.com? 3 Is this encrypted with the CORRECT certificate? Browser DNS Resolver
23 What About This? Server DNS Server TLS-encrypted web page with CORRECT certificate Firewall (or attacker) TLS-encrypted web page with NEW certificate (re-signed by firewall) Browser
24 Problems? Server DNS Server TLS-encrypted web page with CORRECT certificate Firewall TLS-encrypted web page with NEW certificate (re-signed by firewall) Browser
25 Problems? Server DNS Server TLS-encrypted web page with CORRECT certificate Firewall Log files or other servers TLS-encrypted web page with NEW certificate (re-signed by firewall) Browser Potentially including personal information
26 Issues A Certificate Authority (CA) can sign ANY domain. Now over 1,500 CAs there have been compromises where valid certs were issued for domains. Middle-boxes such as firewalls can re-sign sessions.
27 A Powerful Combination TLS/SSL = encryption + limited integrity protection DNSSEC = strong integrity protection How to get encryption + strong integrity protection? TLS + DNSSEC = DANE
28 DNS-Based Authentication of Named Entities (DANE) Q: How do you know if the TLS (SSL) certificate is the correct one the site wants you to use? A: Store the certificate (or fingerprint) in DNS (new TLSA record) and sign them with DNSSEC. A browser that understand DNSSEC and DANE will then know when the required certificate is NOT being used. Certificate stored in DNS is controlled by the domain name holder. It could be a certificate signed by a CA or a selfsigned certificate.
29 DANE Server DNS Server TLS-encrypted web page with CORRECT certificate Firewall (or attacker) example.com? DNSKEY RRSIGs TLSA Log files or other servers TLS-encrypted web page with NEW certificate (re-signed by firewall) DANE-equipped browser compares TLS certificate with what DNS / DNSSEC says it should be. Browser w/dane
30 DANE Not Just For The DANE defines protocol for storing TLS certificates in DNS Securing transactions is the obvious use case Other uses also possible: via S/MIME VoIP Jabber/XMPP?
31 DNSSEC Deployment In Asia
32 Map courtesy of Shinkuro, Inc.
33 Map courtesy of Shinkuro, Inc.
34 Panel Discussion
35 Our Panel Moderator: Dan York, Senior Content Strategist, Internet Society Panelists: Sanjeev Gupta, Principal Technical Architect, DCS1 Pte Jitender Kumar, Technical Account Manager, Afilias Richard Lamb, DNSSEC Program Manager, ICANN
36 Next Steps In Deploying DNSSEC
37 Three Steps TLD Operators Can Take: 1. Sign your TLD Tools and services available to help automate process 2. Accept DS records Make it as easy as possible (and accept multiple records) 3. Work with your registrars Help them make it easy for DNS hosting providers and registrants 4. Help With Statistics Can you help by providing statistics? Implement DNSSEC and make your TLD more secure
38 Three Steps For Network Operators and Enterprises 1. Deploy DNSSEC-validating DNS resolvers 2. Sign your own domains where possible 3. Help promote support of DANE protocol Allow usage of TLSA record. Let browser vendors and others know you want to use DANE. Help raise awareness of how DANE and DNSSEC can make the Internet more secure.
39 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC and other Internet technologies: Case Studies Tutorials Videos Whitepapers News, information English content, initially, but will be translated into other languages.
40 Dan York, CISSP Senior Content Strategist, Internet Society Thank You!
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment Dan York, CISSP Senior Content Strategist, Internet Society Eurasia Network Operators' Group (ENOG) 4 Moscow, Russia October
Introduction to the DANE Protocol
Introduction to the DANE Protocol ICANN 47 July 17, 2013 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC, routing and other Internet technologies: Case Studies
Next Steps In Accelerating DNSSEC Deployment
Next Steps In Accelerating DNSSEC Deployment Dan York, CISSP Senior Content Strategist, Internet Society DNSSEC Deployment Workshop, ICANN 45 Toronto, Canada October 17, 2012 Internet Society Deploy360
Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology
SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2
DNSSEC. Introduction. Domain Name System Security Extensions. AFNIC s Issue Papers. 1 - Organisation and operation of the DNS
AFNIC s Issue Papers DNSSEC Domain Name System Security Extensions 1 - Organisation and operation of the DNS 2 - Cache poisoning attacks 3 - What DNSSEC can do 4 - What DNSSEC cannot do 5 - Using keys
DNSSEC Applying cryptography to the Domain Name System
DNSSEC Applying cryptography to the Domain Name System Gijs van den Broek Graduate Intern at SURFnet Overview First half: Introduction to DNS Attacks on DNS Second half: DNSSEC Questions: please ask! DNSSEC
DANE Secured E-Mail Demonstration. Wes Hardaker Parsons <[email protected]>
DANE Secured E-Mail Demonstration Wes Hardaker Parsons Overview My Background In scope topics Securing E-Mail Requirements Implementing Each Requirement 2 My Background Part of the Network Security
Securing End-to-End Internet communications using DANE protocol
Securing End-to-End Internet communications using DANE protocol Today, the Internet is used by nearly.5 billion people to communicate, provide/get information. When the communication involves sensitive
A Step-by-Step guide for implementing DANE with a Proof of Concept
A Step-by-Step guide for implementing DANE with a Proof of Concept Sandoche BALAKRICHENAN, Stephane BORTZMEYER, Mohsen SOUISSI AFNIC R&D {sandoche.balakrichenan, stephane.bortzmeyer, mohsen.souissi}@afnic.fr
Securing DNS Infrastructure Using DNSSEC
Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias [email protected] February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival
One year of DANE Tales and Lessons Learned. sys4.de
One year of DANE Tales and Lessons Learned sys4.de DANE secures Security Why secure Security? Encryption Models Opportunistic Encryption > Expect anything > Proceed if absent > Try if offered > Proceed
Computer Networks: Domain Name System
Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
FAQ (Frequently Asked Questions)
FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
DNS Risks, DNSSEC. Olaf M. Kolkman and Allison Mankin. [email protected] and [email protected]. http://www.nlnetlabs.nl/ 8 Feb 2006 Stichting NLnet Labs
DNS Risks, DNSSEC Olaf M. Kolkman and Allison Mankin [email protected] and [email protected] 8 Feb 2006 Stichting NLnet Labs DNSSEC evangineers of the day Allison: Independent consultant Member of the Internet2
Where is Hong Kong in the secure Internet infrastructure development. Warren Kwok, CISSP Internet Society Hong Kong 12 August 2011
The Internet is for Everyone. Become an ISOC Member. Cyber Security Symposium 2011 Where is Hong Kong in the secure Internet infrastructure development Warren Kwok, CISSP Internet Society Hong Kong 12
A quick overview of the DANE WG. * DNS-based Authentication of Named Entities
A quick overview of the DANE WG * DNS-based Authentication of Named Entities Some background... When you connect to https://www.example.com you use SSL (actually TLS) to secure your connection. Need a
DNSSEC: The Antidote to DNS Cache Poisoning and Other DNS Attacks
F5 Technical Brief DNSSEC: The Antidote to DNS Cache Poisoning and Other DNS Attacks Domain Name System (DNS) provides one of the most basic but critical functions on the Internet. If DNS isn t working,
American International Group, Inc. DNS Practice Statement for the AIG Zone. Version 0.2
American International Group, Inc. DNS Practice Statement for the AIG Zone Version 0.2 1 Table of contents 1 INTRODUCTION... 6 1.1 Overview...6 1.2 Document Name and Identification...6 1.3 Community and
DNS at NLnet Labs. Matthijs Mekking
DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the
Analyzing DANE's Response to Known DNSsec Vulnerabilities
Analyzing DANE's Response to Known DNSsec Vulnerabilities Matthew Henry Joseph Kirik Emily Scheerer UMBC UMBC UMBC [email protected] [email protected] [email protected] May 9, 2014 Abstract: SSL/TLS is currently
The Domain Name System from a security point of view
The Domain Name System from a security point of view Simon Boman Patrik Hellström Email: {simbo105, pathe321}@student.liu.se Supervisor: David Byers, {[email protected]} Project Report for Information Security
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management A Report from the ICANN Security and Stability Advisory Committee (SSAC) 03 June 2011 SAC049 1 Preface This is a Report of the Security and
DNS Root NameServers
DNS Root NameServers An Overview Dr. Farid Farahmand Updated: 9/24/12 Who- is- Who! Over half million networks are connected to the Internet 5 billion users by 2015! Network numbers are managed by ICANN
DNSSEC Root Zone. High Level Technical Architecture
DNSSEC Root Zone Prepared by the Root DNSSEC Design Team Joe Abley David Blacka David Conrad Richard Lamb Matt Larson Fredrik Ljunggren David Knight Tomofumi Okubo Jakob Schlyter Version 1.2.1 October
DNSSEC Practice Statement (DPS)
DNSSEC Practice Statement (DPS) 1. Introduction This document, "DNSSEC Practice Statement ( the DPS ) for the zones under management of Zodiac Registry Limited, states ideas of policies and practices with
Reverse Proxy Guide. Version 2.0 April 2016
Version 2.0 April 2016 Reverse Proxy Guide Copyright 2016 iwebgate. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
DNSSEC for Everybody: A Beginner s Guide
DNSSEC for Everybody: A Beginner s Guide San Francisco, California 14 March 2011 4:00 to 5:00 p.m. Colonial Room The Schedule 2 This is Ugwina. She lives in a cave on the edge of the Grand Canyon... This
DNSSEC: A Vision. Anil Sagar. Additional Director Indian Computer Emergency Response Team (CERT-In)
DNSSEC: A Vision Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Outline DNS Today DNS Attacks DNSSEC: An Approach Countering DNS Attacks Conclusion 2 DNS Today DNS is
DNS and BIND. David White
DNS and BIND David White DNS: Backbone of the Internet Translates Domains into unique IP Addresses i.e. developcents.com = 66.228.59.103 Distributed Database of Host Information Works seamlessly behind
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
THE MASTER LIST OF DNS TERMINOLOGY. v 2.0
THE MASTER LIST OF DNS TERMINOLOGY v 2.0 DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To help people
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
Ordinary DNS: www.google.com A? k.root-servers.net. com. NS a.gtld-servers.net a.gtld-servers.net A 192.5.6.30. Client's Resolver
Ordinary DNS: www.google.com A? com. NS a.gtld-servers.net a.gtld-servers.net A 192.5.6.30 k.root-servers.net Ordinary DNS: www.google.com A? com. NS a.gtld-servers.net a.gtld-servers.net A 192.5.6.30
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
WHITE PAPER. Best Practices DNSSEC Zone Management on the Infoblox Grid
WHITE PAPER Best Practices DNSSEC Zone Management on the Infoblox Grid What Is DNSSEC, and What Problem Does It Solve? DNSSEC is a suite of Request for Comments (RFC) compliant specifications developed
Domain Name System Security
Domain Name System Security Guevara Noubir Network Security Northeastern University 1 Domain Name System DNS is a fundamental applica=on layer protocol Not visible but invoked every =me a remote site is
The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. <[email protected]> Duisburg, June 19, 2015
The Impact of DNSSEC on the Internet Landscape Matthäus Wander Duisburg, June 19, 2015 Outline Domain Name System Security problems Attacks in practice DNS Security Extensions
SSL and Browsers: The Pillars of Broken Security
SSL and Browsers: The Pillars of Broken Security Ivan Ristic Wolfgang Kandek Qualys, Inc. Session ID: TECH-403 Session Classification: Intermediate SSL, TLS, And PKI SSL (or TLS, if you prefer) is the
Lesson 13: DNS Security. Javier Osuna [email protected] GMV Head of Security and Process Consulting Division
Lesson 13: DNS Security Javier Osuna [email protected] GMV Head of Security and Process Consulting Division Introduction to DNS The DNS enables people to use and surf the Internet, allowing the translation
Unbound a caching, validating DNSSEC resolver. Do you trust your name server? Configuration. Unbound as a DNS cache (SEC-less)
Unbound a caching, validating DNSSEC resolver UKUUG Spring 2011 Conference Leeds, UK March 2011 Jan-Piet Mens $ dig 1.1.0.3.3.0.8.1.7.1.9.4.e164.arpa naptr Do you trust your name server? DNS clients typically
Namecoin as alternative to the Domain Name System
Namecoin as alternative to the Domain Name System Xander Lammertink Author, UvA System and Network Engineering [email protected] Marco Davids Supervisor, SIDN Labs Abstract: This paper researches
Networking Domain Name System
IBM i Networking Domain Name System Version 7.2 IBM i Networking Domain Name System Version 7.2 Note Before using this information and the product it supports, read the information in Notices on page
Digital certificates and SSL
Digital certificates and SSL 20 out of 33 rated this helpful Applies to: Exchange Server 2013 Topic Last Modified: 2013-08-26 Secure Sockets Layer (SSL) is a method for securing communications between
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce 18/02/15 Networks: DNS attacks 1 Domain Name System The domain name system (DNS) is an applica>on- layer protocol
Using the Domain Name System for System Break-ins
Using the Domain Name System for System Break-ins Steven M. Bellovin Presented by: Thomas Repantis [email protected] CS255-Computer Security, Winter 2004 p.1/37 Overview Using DNS to spoof a host s name
THE MASTER LIST OF DNS TERMINOLOGY. First Edition
THE MASTER LIST OF DNS TERMINOLOGY First Edition DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To
A Security Evaluation of DNSSEC with NSEC3
A Security Evaluation of DNSSEC with NSEC3 Jason Bau Stanford University Stanford, CA, USA [email protected] Abstract Domain Name System Security Extensions (DNSSEC) with Hashed Authenticated Denial of
DNSSEC. What is DNSSEC? Why is DNSSEC necessary? Ensuring a secure Internet
SEC Ensuring a secure Internet What is SEC? SEC is an extension of the Domain Name System (), that ensures the authenticity and integrity of the data in replies. Technical measures have been implemented
DNS SECURITY TROUBLESHOOTING GUIDE
DNS SECURITY TROUBLESHOOTING GUIDE INTERNET DEPLOYMENT OF DNS SECURITY 27 November 2006 Table of Contents 1. INTRODUCTION...3 2. DNS SECURITY SPECIFIC FAILURE MODES...3 2.1 SIGNATURES...3 2.1.1 Signature
The basic groups of components are described below. Fig X- 1 shows the relationship between components on a network.
Elements of Email Email Components There are a number of software components used to produce, send and transfer email. These components can be broken down as clients or servers, although some components
DNSSEC in your workflow
DNSSEC in your workflow Presentation roadmap Overview of problem space Architectural changes to allow for DNSSEC deployment Deployment tasks Key maintenance DNS server infrastructure Providing secure delegations
DNSSEC and DNS Proxying
DNSSEC and DNS Proxying DNS is hard at scale when you are a huge target 2 CloudFlare DNS is big 3 CloudFlare DNS is fast 4 CloudFlare DNS is always under attack 5 CloudFlare A secure reverse proxy for
Monitoring the DNS. Gustavo Lozano Event Name XX XXXX 2015
Monitoring the DNS Gustavo Lozano Event Name XX XXXX 2015 Agenda 1 2 3 Components of the DNS Monitoring gtlds Monitoring other components of the DNS 4 5 Monitoring system Conclusion 2 Components of the
Presented by Greg Lindsay Technical Writer Windows Server Information Experience. Presented at: Seattle Windows Networking User Group April 7, 2010
Presented by Greg Lindsay Technical Writer Windows Server Information Experience Presented at: Seattle Windows Networking User Group April 7, 2010 Windows 7 DNS client DNS devolution Security-awareness:
Basic Vulnerability Issues for SIP Security
Introduction Basic Vulnerability Issues for SIP Security By Mark Collier Chief Technology Officer SecureLogix Corporation [email protected] The Session Initiation Protocol (SIP) is the future
DNSSEC in stats. GC-SEC Global Cyber Security Center. Andrea Rigoni. CENTR Bruxelles, 7th October 2010. Global Cyber Security Center Director General
Global Cyber Security Center DNSSEC in stats CENTR Bruxelles, 7th October 2010 Andrea Rigoni Global Cyber Security Center Director General [email protected] On the 7 th of May 2010 Poste Italiane
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation s Course,
DNS Security: New Threats, Immediate Responses, Long Term Outlook. 2007 2008 Infoblox Inc. All Rights Reserved.
DNS Security: New Threats, Immediate Responses, Long Term Outlook 2007 2008 Infoblox Inc. All Rights Reserved. A Brief History of the Recent DNS Vulnerability Kaminsky briefs key stakeholders (CERT, ISC,
Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
OWASP AppSec APAC 2012 The OWASP Foundation http://www.owasp.org Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
Apache Security with SSL Using Ubuntu
Apache Security with SSL Using Ubuntu These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Some SSL background
Introduction to the Domain Name System
CHAPTER 14 The Domain Name System (DNS) handles the growing number of Internet users. DNS translates names, such as www.cisco.com, into IP addresses, such as 192.168.40.0 (or the more extended IPv6 addresses),
CentralNic Privacy Policy Last Updated: July 31, 2012 Page 1 of 12. CentralNic. Version 1.0. July 31, 2012. https://www.centralnic.
CentralNic Privacy Policy Last Updated: July 31, 2012 Page 1 of 12 CentralNic Privacy Policy Version 1.0 July 31, 2012 https://www.centralnic.com/ CentralNic Privacy Policy Last Updated: February 6, 2012
Internet Privacy Options
2 Privacy Internet Privacy Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 19 June 2014 Common/Reports/internet-privacy-options.tex, r892 1 Privacy Acronyms
DNSSEC Misconfigurations: How incorrectly configured security leads to unreachability
DNSSEC Misconfigurations: How incorrectly configured security leads to unreachability Niels L. M. van Adrichem, Antonio Reyes Lúa, Xin Wang, Muhammad Wasif, Ficky Fatturrahman and Fernando A. Kuipers Network
Secure Domain Name System (DNS) Deployment Guide
NIST Special Publication 800-81-2 Secure Domain Name System (DNS) Deployment Guide Ramaswamy Chandramouli Scott Rose C O M P U T E R S E C U R I T Y NIST Special Publication 800-81-2 Secure Domain Name
NANOG DNS BoF. DNS DNSSEC IPv6 Tuesday, February 1, 2011 NATIONAL ENGINEERING & TECHNICAL OPERATIONS
NANOG DNS BoF DNS DNSSEC IPv6 Tuesday, February 1, 2011 NATIONAL ENGINEERING & TECHNICAL OPERATIONS The Role Of An ISP In DNSSEC Valida;on ISPs act in two different DNSSEC roles, both signing and valida;ng
Security in the Network Infrastructure - DNS, DDoS,, etc.
Security in the Network Infrastructure - DNS, DDoS,, etc. GTER, São Paulo December 8, 2006 Steve Crocker, [email protected] Russ Mundy, [email protected] Proactive Security Build security into the infrastructure
F5 and Infoblox DNS Integrated Architecture Offering a Complete Scalable, Secure DNS Solution
F5 and Infoblox DNS Integrated Architecture Offering a Complete Scalable, Secure DNS Solution As market leaders in the application delivery market and DNS, DHCP, and IP Address Management (DDI) market
DNSSEC Practice Statement.OVH
DPS.OVH 11/06/2013 1 DNSSEC Practice Statement.OVH Registry domain signature policy and conditions of implementation (Version 02 11/06/2013) DPS.OVH 11/06/2013 2 Document management Document identification
Acano solution. Security Considerations. August 2015 76-1026-01-E
Acano solution Security Considerations August 2015 76-1026-01-E Contents Contents 1 Introduction... 3 2 Acano Secure Development Lifecycle... 3 3 Acano Security Points... 4 Acano solution: Security Consideration
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
A Best Practices Architecture for DNSSEC
WHITEPAPER A Best Practices Architecture for DNSSEC Cricket Liu, Vice President of Architecture Background The Domain Name System is the Internet s standard naming service. DNS is responsible for mapping
Remote DNS Cache Poisoning Attack Lab
SEED Labs Remote DNS Cache Poisoning Attack Lab 1 Remote DNS Cache Poisoning Attack Lab Copyright c 2014 Wenliang Du, Syracuse University. The development of this document is/was funded by the following
Domain Name System Security (DNSSEC)
Dept. of Homeland Security Science & Technology Directorate Domain Name System Security (DNSSEC) CA CISO Lecture Series Sacramento, CA December 15, 2009 Douglas Maughan, Ph.D. Program Manager, CCI [email protected]
DNSSEC. Introduction Principles Deployment
DNSSEC Introduction Principles Deployment Overview What we will cover The problems that DNSSEC addresses The protocol and implementations Things to take into account to deploy DNSSEC The practical problems
Securing LAN Connected Devices in Industrial Sites with TLS and Multicast DNS
Securing LAN Connected Devices in Industrial Sites with TLS and Multicast DNS Tero Keski-Valkama May 28, 2015 Version 1.0 Abstract This whitepaper outlines a more flexible and more secure user interface
Security server configuration
csc Security server configuration Security server 5.0x. Version 0.3 pmuhonen 4/15/2014 Date Version Description 10.3.2014 0.1 Initial version 24.3.2014 0.2 - changed LY-tunnus to Y-tunnus - Section 10