Summary
This discussion brief from Authentic Web explains why enterprises are exposed on their external DNS network, what will happen if the exposures aren’t fixed, what it costs, and what a CISO should prioritize. Its main claim is that two factors, lack of clear ownership and lack of digital control systems, create material risk, at the same time as DNS incidents become more frequent and more costly.
In every organization where we run our external DNS network audits, we uncover glaring deficiencies in DNS hygiene and security. These gaps expose the business and its customers to cyber risk. This condition coincides with increasing frequency of external DNS incidents. It’s time for a CISO directive.
Peter LaMantia, CEO, Authentic Web Inc.
Key findings
- IDC’s 2021 Global DNS Threat Report puts the average direct cost of a DNS attack at about $950,000 per incident in 2021, against $4,240,000 for the global average total cost of a data breach (IBM, 2021).
- 87% of organizations in the IDC survey experienced a DNS attack in 2021, up from 79% in 2020, with an average of 7.6 attacks per year.
- Seven exposure types recur in external DNS audits: DNSSEC failures, multiple live DNS services, change control gaps, HTTP-only redirects, missing SPF and DMARC, poor DNS hygiene and dangling DNS records.
- The recommended CISO directive: assign ownership and prioritize modernizing systems so teams can get and keep control.
DNS threat vectors
The brief splits DNS threats into two groups.
| Inbound DNS threats to internal networks | External DNS network threats | |
|---|---|---|
| What they are | Inbound DNS traffic designed to attack the business through data exfiltration, command and control, system compromise, or making DNS inoperable. | DNS hijacking, social engineering or phishing used as first-strike vectors for later cybercrimes. |
| Why they exist | Malicious traffic patterns in DNS. | Management gaps in DNS change controls and security policy enforcement; lack of visibility, controls and automation for DNS hygiene. |
| How they are addressed | Blocking and traffic analysis services that spot abnormal DNS patterns and stop traffic before it compromises internal systems. | Service providers that give IT control systems to get and keep control. |
This brief covers external DNS network threats and causes.
Domain and external DNS network management risk
Two factors above all others put the enterprise and its customers at risk:
- Lack of ownership. When domains and DNS zone files are ungoverned, with no end-to-end ownership or enforced security policy, you are likely exposed. Many teams are stakeholders, but domains and DNS are often managed in silos without clear oversight. Without clear ownership, individuals put in no effort, are frustrated and demotivated, an environment of blame develops, and business risk increases.
- Lack of digital control systems. Where domains and DNS zones are not managed under a centralized control system, security exposure and change management compliance gaps generally go unaddressed. Security experts recognize this as a material risk.
Why your enterprise is exposed and what will happen
The exposures below come from real DNS audit data on large enterprise external DNS networks. Root causes: lack of clear internal ownership, governance and digital control systems. Consequences: digital outage, brand impersonation, ransomware, theft of personally identifiable information, credential theft and DDoS.
| Exposure type | Why the enterprise is exposed | What will happen |
|---|---|---|
| DNS hijack, or man-in-the-middle: DNSSEC failures or not enabled | DNSSEC records may exist, but compliance checks show few or none properly configured, so they don’t function. Many companies fail to enable DNSSEC at all. | Without DNSSEC, a DNS cache poisoning attack can redirect users to a malicious website. Attackers can route traffic through their own servers, harvest data and pass traffic on, and neither the enterprise nor the customer would know. A recent example is the Sea Turtle attack. |
| Social engineering: multiple live DNS services | Most enterprises have several live DNS services, largely from untended legacy accounts. Access permissions are unclear, and change management visibility is incomplete or absent, so accounts can be taken over. | Ungoverned DNS accounts are vulnerable to social engineering in which parties take control of the DNS. At risk: customer login credentials, internal credentials such as VPN, customer personal information and ransomware. |
| Internal actor, malicious or by error: change control gaps | Lack of DNS network visibility and change management lets employees make any change without oversight. | Without change management and change history, staff can maliciously or accidentally configure DNS in ways that create security gaps. |
| Session compromise and man-in-the-middle: end-to-end encryption gaps | Redirect servers are often not set up with HTTPS. DNS audits typically show hundreds of insecure redirects, each an attack vector. | Attackers compromise a session left open by an HTTP-only redirect, to eavesdrop and harvest data or redirect users. Browser warnings that grow stricter hurt consumer trust, and SEO suffers because search engines reward end-to-end HTTPS. |
| Phishing: SPF and DMARC implementation | SPF and DMARC records are typically set on only a handful of domains. If you own a domain, you must manage and secure it. | Attackers can send email from an enterprise-owned domain to a target list or as spear phishing to an individual. It works because the email appears to come from a genuine enterprise domain. |
| DNS network reconnaissance: DNS hygiene | External DNS is insecure by design and gives a globally accessible map of your network and its vulnerabilities. | Attackers find DNS security gaps and servers outside InfoSec policy. Most cybersecurity incidents start with an external DNS scan used to map networks, inspect endpoints and look for software or configuration gaps. Poor hygiene signals weak controls and marks the organization as an attractive target; good hygiene signals the opposite. |
| Dangling DNS: orphaned DNS records | Subdomain A records and CNAMEs are set and forgotten over time, and IT lacks tools to ensure every provisioned endpoint is known and governed. | Attackers cycle through cloud provider IPs until they gain control of an orphaned IP, and hunt for dangling CNAMEs whose destination is no longer live, then set up their own resource with the same name to host a malicious site. The risk is greater if the CNAME destination name is used by other enterprise services. |
Business and customer impacts and costs
A DNS network breach can be irreparably damaging. Fallout reaches budgets and costs, brand reputation, consumer trust, careers, team morale and business plan execution. Common cost areas:
- Outage impact, calculated by the hour, on revenue and service delivery.
- Client services teams handling customer needs during an incident.
- IT, infrastructure and InfoSec managing the incident: resolution, containment and lost productivity, internal and vendor.
- Post-mortem responsibility and the work to prevent future incidents. Reactive costs are orders of magnitude higher than proactive ones.
- Brand damage with consumers (acquisition, retention, upsell), investors (market value and outlook) and partners (reputation and deal conditions).
- Regulatory consequences and management costs.
| Average cost of a compromise (USD), 2021 | Amount |
|---|---|
| Direct, DNS-specific cost per incident (IDC DNS Threat Report 2021) | $950,000 |
| Global average total cost of a data breach (IBM Cost of a Data Breach 2021) | $4,240,000 |
DNS security research: frequency and business impact
External DNS networks are an increasingly common attack vector, with frequency and cost both rising. Two sources the brief recommends for building a business case:
IDC 2021 Global DNS Threat Report (June 2021)
Source: efficientip.com/resources/idc-dns-threat-report-2021. It covers both inbound and external DNS threats and shows the rising frequency and cost of DNS attacks. Figures in the brief’s infographic (verify against the report): share of organizations hit by each attack type, 2021 vs 2020.
| Top DNS-based attacks | 2021 | 2020 |
|---|---|---|
| DNS phishing | 49% | 39% |
| DNS-based malware | 38% | 34% |
| DDoS attacks | 29% | 27% |
| DNS hijacking / credential attacks | 27% | 12% |
| DNS tunneling | 24% | 17% |
| Zero-day vulnerabilities | 23% | 16% |
| Cloud instance reconnaissance abuse | 23% | 13% |
Average cost of an attack: $950,000 in 2021 against $924,000 in 2020. Organizations that experienced an attack: 87% in 2021 against 79% in 2020, averaging 7.6 attacks a year. Impacts reported: application downtime 76% (the infographic’s headline figure), in-house application downtime 51% (62% in 2020), cloud service downtime 46% (50%), compromised websites 42% (46%), loss of business 30% (29%), brand damage 27% (29%) and sensitive information stolen 26% (16%).
Interisle: Domain Security, a Critical Component of Enterprise Risk Management (June 2021)
Source: interisle.net/DomainSecurity2021.pdf. Two quotes the brief highlights: “Incidents and responses attract public attention, there is an overemphasis on attack response and underemphasis on pro-active, preventative measures to detect, identify, and mitigate threats before an attack can occur”, and “Because cyber investigators actively look for malicious domain registration indicators such as look-alike domains, many attackers prefer to exploit legitimately registered domain names … the domain hijacking is an enabling attack.”
| Direct attack against the domain holder | Possible consequences to the domain holder | Direct attack against others | Possible consequences to others |
|---|---|---|---|
| Mail redirection | Correspondence or sensitive data disclosure, transaction or CEO fraud | Domain used to distribute spam | Spam, malware distribution, phishing, business email compromise (BEC) |
| Web server redirection | Disruption of online presence or merchant transactions | Redirection to fake sites, data leak, traffic interception, malicious content hosted | Phishing, malware distribution, credential harvesting |
| Web site compromise | Reputational harm, service disruption | Defacement, malicious content insertion, redirection | Loss of confidence in the organization |
| Extortion or domain takeover | Financial loss, online presence disrupted, protracted dispute resolution | Supply chain disruption, necessary service disruption | |
| Data, media or streaming server redirection | Disruption of critical operations, passive surveillance, data disclosure, alteration or destruction | Disclosure of personal data or activities |
Conclusion: the CISO directive
- Domains and DNS are vulnerable to compromise. Operating silos: no clear end-to-end functional team ownership inside the enterprise. System silos: no unified control system to enforce security policy and change management.
- It is extremely hard for IT to get and keep control. Accountability: unclear ownership has left this area lacking in accountability. Legacy systems: teams lack modern systems to see the risk efficiently, let alone address it.
- Impact and probability together require a proactive security posture. Cost: the cost of incidents continues to climb year over year. Probability: the brief says the probability of an incident approaches 100%, “not if but when”.
The CISO directive: get proactive and prioritize action. Assign ownership and prioritize systems modernization to empower teams. Authentic Web offers DNAM (Domain Name Asset Manager) to get and keep control of DNS networks with control, visibility and automation, and DNS Inspector to automate discovery of DNS vulnerabilities and give teams DNS security visibility. To get started, contact info@authenticweb.com.