David Conrad, CTO of The Internet Corporation for Assigned Names and Numbers (ICANN), recently presented a keynote during a webinar we collaborated on with other internet organizations. Below is a summary of his explanation of the domain name system (DNS) ecosystem, its vulnerabilities, and threat mitigations.

The Internet, as we know, largely depends on DNS. It is akin to the telephone book of the Internet, translating domain names into IP address, so users can easily look for websites with names instead of a string of numbers. The DNS isn't a single entity, and comprises the protocol, namespace, and service; its ecosystem extends to include software, provisioning, and others.

The DNS protocol, invented in 1983, was intended to be lightweight with a simple query-response behavior. To allow the DNS to scale, it was designed with a tree-like structure; each branch and level of domains, such as top-level domains, can be independently administered. With an expanding structure and multiple segments in the DNS ecosystem software, registries, network operators, hosting providers and more the DNS' complexity adds to the challenge in security.

David shared that "the DNS is a critical component of the Internet, and the DNS ecosystem is large, complex, and has myriad players of varying levels of competence, resulting in a (very) large attack surface."

When the DNS was first developed and defined, with no protection against data corruption, security wasn't a focus. Below are some of the DNS ecosystem vulnerabilities and their mitigations.

We have seen recent incidences compromising the DNS on various fronts:

The DNS provides a ubiquitous service critical to the function of the Internet. This, combined with the large attack surface, make the DNS ecosystem an excellent (and frequent) target of attack. It's constantly evolving to improve its efficiency, security, and function, such as DNSSEC. But each part of the DNS and its larger ecosystem has its own set of vulnerabilities, from bugs within the DNS protocol itself to how the DNS is deployed for operation. Hence, fixes for those vulnerabilities requires participation of all actors within the ecosystem from registrants to registries, DNS operators to software developers, end-users to governments to play a role in ensuring the security of DNS and the Internet.

To listen to the full explanation and details by David Conrad, watch the recorded webinar here.

See the original post:

The DNS Ecosystem, Its Vulnerabilities, and Threat Mitigations - CircleID