Are DNS Servers Secure?
Many of today’s sophisticated attacks rely on DNS activity. Malware, ransomware, phishing, and other scams often use DNS to stage the internet infrastructure used to support each stage of their attacks.
For example:
- DNS tunneling is often used to deliver payloads encoded in DNS queries and responses, exfiltrate data from compromised networks, and execute command and control attacks
- DNS beaconing is often used to establish communication with a command and control server using only DNS, which is almost always allowed in a network
Cisco Umbrella is a security solution that evolved from OpenDNS and the OpenDNS acquisition. The Cisco Umbrella is basically a cloud deliver solution that blocks malicious destinations using DNS.
It can be accomplished by forwarding DNS queries to the umbrella cloud on assistant DNS servers, or by running the Umbrella virtual appliances, or using things like, you know, the Windows, or Mac OSX roaming clients, or the Cisco security connector for iOS for example.
Umbrella looks at the patterns of DNS requests from devices, and uses them to detect compromised systems, commanding control callbacks, malware and phishing attempts, algorithm-generated domains, domain co-occurrences, newly registered domains, and malicious traffic and payloads, that never reach their target. Your company will get first line of defence with Cisco Umbrella.
Global Infrastructure
The Cisco Umbrella global infrastructure includes dozens of data centers around the world, that resolve more than 100 billion DNS requests, from millions of users every day. Umbrella data centers are peered with more than 500 of the top ISPs, and content delivery networks, to exchange BGP routes, and ensure that requests are routed efficiently, without adding any latency over regional DNS providers
Anycast
Umbrella uses Anycast, specifically whenever it comes to Anycast, it's actually used in order to provide reliability of the recursive DNS services and the servers that they actually have.
All data centers announce the same IP address and all the requests are transparently sent to the fastest and the lowest latency data center that is actually available, you know, closer to you.
The Cisco Umbrella anycast IP addresses are 208.67.222.222 and 208.67.220.220.
Secure Internet Gateway
When Cisco Umbrella servers receive a DNS request, they first identify which end customer the request came from, and which policy to apply. Next, Cisco Umbrella determines whether the request is safe or whitelisted, malicious or blacklisted, or risky. Safe requests are allowed to be routed as usual, and malicious requests are routed to a block page.
Risky requests can be routed to the cloud-based proxy for deeper inspection. This concept of cloud-based proxy is the basis for the Secure Internet Gateway, or SIG.
Traditional web proxies or gateways examine all internet requests, which adds latency or complexity. The Cisco Umbrella Secure Internet Gateway proxy intercepts and inspects only requests for risky domains.
Cisco Umbrella Investigate
Cisco Umbrella Investigate provides organizations access to global intelligence that can be used to enrich security data in events or help with incidence response. Global intelligence includes and Cisco Talos threat intelligence and third-party intelligence.
Investigate provides the most complete view of an attacker's infrastructure and enables security teams to discover malicious domains, IP addresses and file hashes and even predict emerging threats.
With the integration of Cisco AMP Threat Grid, data in Investigate, intelligence about an attacker's infrastructure can be complemented by AMP Threat Grid intelligence about malware files, providing a complete view of the infrastructure used in an attack.
Umbrella DNS is the simplest way to protect your users everywhere in minutes. You can go through the following link that guides you to Setting up your recursive DNS:
https://umbrella.cisco.com/products/recursive-dns-services
Cisco is offering 14-day free trail of Umbrella dns service. For more details, please go through the following link:
To know more about Cisco Umbrella product packages, please use the following link:
1 Comment
