Overview: DNS security and compliance in the healthcare sector
Healthcare is a top target for cyber criminals in part because its networks and data are exposed on the DNS. Authentic Web’s healthcare DNS security audit found non-compliance in IT controls across many information security frameworks. This discussion brief by Peter LaMantia, CEO of Authentic Web Inc., helps teams identify and remediate these risks and compliance gaps.
Key findings
- Healthcare is the most cyber-attacked sector in North America, recently surpassing banking and finance.
- Healthcare is subject to several InfoSec frameworks, which are often not applied to domain asset and DNS management.
- The external DNS remains an open vulnerability. Current DNS practices fall short of compliance requirements in SOC 2, CIS, NIST and ISO.
- In the 2024 benchmark of 25 healthcare organizations (9,269 domains), 35% of CNAMEs were exposed, 17% of domains had lame delegations, about half of domains lacked SPF and DMARC coverage, and 99% were not DNSSEC-signed.
Purpose of the paper
The paper examines external DNS management as a known and under-addressed vulnerability among healthcare providers. Its observations:
- The DNS is a principal threat vector, enabling cyber-attackers in healthcare.
- Compliance standards for external DNS management are inconsistently followed by healthcare providers.
- DNS management best practices can mitigate healthcare cyber-risk.
The importance of the Domain Name System (DNS) to your organization’s cybersecurity cannot be understated… A malicious party (can) exploit a weakness in DNS (and) re-route sensitive traffic, including Protected Health Information (PHI), Personally Identifiable Information (PII) and other valuable information from the intended recipient to (unauthorized sites.)
Brian G. Cesaretto, Health Law, Epstein Becker Green
The current state of IT security threats and compliance in healthcare
Few sectors are as focused on IT security compliance as healthcare, a nexus of sensitive patient data intersecting with payment authorities, insurance companies and other stakeholders. Healthcare providers are collectively the most cyber-attacked sector in North America, recently surpassing banking and finance. A cited report found 34.9% of cyberattacks occurred in health care, making it the most attacked sector for the second year in a row, most likely because of the heavy regulation around Personal Health Information (PHI). The report also highlighted a lack of budget, outdated software, and the ability to remotely share personal data between patients and hospital systems as avenues for hackers.
Despite the many security framework standards healthcare providers follow, they remain a perennial target for ransomware, data exfiltration, phishing and more.
IT security frameworks and the DNS
Managing external domains and DNS controls is not prescriptively specified in every security framework, but the relevant themes are clear. CIS18, SOC 2, PCI, NIST, GDPR and HITRUST CSF contain standards that relate to domains and DNS:
| Framework standard | What it requires | Domain and DNS applicability |
|---|---|---|
| 1. IT controls and user access controls | Only authorized individuals and systems have appropriate access to critical company assets and systems. | Domains and DNS are mission-critical network assets and systems. |
| 2. Logging, audits, audit management, auditability | Track and report all activity related to interaction with company assets, networks, security information, monitoring. | Domain and DNS change history and change reporting required. |
| 3. Change management | Any material change to systems and assets must go through a change management control process. | Change control workflow required to edit domain and DNS records. |
| 4. Monitoring for vulnerabilities | All known cyber attack vectors must be actively monitored and reported on. | Systems to identify and monitor DNS-specific attack vectors. |
| 5. Backup, recovery and availability of critical systems | Companies must be able to back up and restore key systems and information to ensure business continuity. | Secondary DNS and zone file backups are required. |
| 6. Network security | No unauthorized or unmanaged access to any company networking systems. | Includes external DNS and domains. |
Conclusion. If healthcare providers do not apply InfoSec frameworks to their management of domain assets and DNS network, they will fail compliance. More importantly, they greatly increase exposure to known security threats that keep playing out in the sector.
How and why the DNS is at risk in healthcare
External DNS: the soft underbelly of IT security
External DNS management is widely acknowledged as a principal source of cyber breaches and data loss in healthcare and other sectors. The DNS is a publicly accessible network that cyber criminals use to discover and exploit enterprise and customer data. Security compliance for DNS management is inconsistently covered by the eight most important security frameworks used in healthcare: references to external DNS management range from explicit (NIST, ISO and CIS) to indirect (HIPAA, PCI DSS, GDPR and SOC 2).
A study by Efficient IP and IDC (2022) shows the importance of DNS to enterprise cybersecurity strategy: 73% of respondents say DNS security is critical.
Why DNS management fails standards in healthcare
- Multiple domain registrars and managed DNS providers. Healthcare providers often own hundreds of domains registered across multiple registrars and managed DNS provider services.
- Lack of clear ownership. Internal ownership of domain assets and DNS is split across departments: network infrastructure, legal (IP), InfoSec, and product and marketing.
- Complex, decentralized environment. Domain and DNS management involves domains, zone file records and DNS security configurations that are not centrally managed, governed for compliance or monitored.
The global DNS infrastructure is also publicly accessible, and dangerously so: unlike internal networks, the external DNS can be viewed, probed and exploited by outside parties.
DNS security consequences
The smallest misconfigurations can expose healthcare providers: insecure redirect domains, orphaned or missing CNAMEs, and missing or misconfigured DNS settings such as SPF, DMARC, DNSSEC and DKIM. Malicious parties constantly scan for these gaps to run man-in-the-middle exploits, domain hijacking, DNS cache poisoning, takeover of orphaned A record and CNAME endpoints, and phishing scams that use the provider’s own domains.
How DNS management is non-compliant
Vendor fragmentation in the domain and managed DNS space has left this area without robust, compliant change management. Domain and DNS management is often the exception to otherwise compliant healthcare IT practice. External DNS management often lacks:
- Role-based, permissioned access to DNS change management.
- Tamper-proof logging of changes and auditable change reports.
- Correctly configured and monitored DNS security settings.
- MFA or single sign-on access controls across all vendor systems.
- Network asset and endpoint visibility and governance.
Healthcare mergers and acquisitions make matters worse
Every time a healthcare enterprise acquires an entity, it also acquires the latent security issues in the target’s domain assets and DNS network. These issues are notoriously difficult to identify, and due diligence rarely determines the full security posture of target domain and DNS assets. Serial M&A, a strategic aim of many large healthcare providers, compounds the risk as newly acquired DNS operations pile on previous acquisitions without complete integration. Best-practice responses:
- Always conduct a thorough external audit of target domain assets and DNS networks.
- Consolidate acquired assets to a single domain registrar and managed DNS service.
- Place all acquired assets under a unified, compliant change management system.
Four best practice recommendations
1. Benchmark your DNS security posture with a domain and DNS security audit
Audits confirm that every organization has security gaps in its domain assets, corresponding zone files and DNS security settings. Internal audits that providers run themselves are manual, costly and rarely complete. Healthcare providers believe their external DNS is compliant. It is not.
2. Consolidate domains and DNS to a single registrar and managed DNS provider
Multiple, non-integrated administrative controls for each service make critical domain, DNS and TLS certificate details less visible to stakeholders and harder to manage. Healthcare providers believe their domain assets and DNS are locked down. They are not.
3. Place domains, DNS and TLS certificates under a standards-compliant change management system
ISO/IEC, NIST and CIS demand role-based, permissioned access controls and a tamper-proof audit history of all access and change activity. Few healthcare providers follow these measures in domain and DNS management, even though they are standards-compliant in most of their network operations.
4. Place domains and DNS under a DNS-specific security inspection and monitoring system
New vulnerabilities can surface at any time from internal staff and from the ongoing efforts of unauthorized external parties, so DNS security must be monitored continually. Healthcare providers’ DNS security posture demands constant, ongoing framework compliance. These four actions can demonstrably reduce the external DNS vulnerabilities that help perpetuate successful attacks on the sector.
Appendix: Healthcare DNS Security and Compliance Benchmark Report 2024
An industry-wide assessment of external DNS security posture, powered by DNS Inspector. Failure to maintain good DNS hygiene, establish and enforce DNS security policies, and govern change management makes enterprises non-compliant with security frameworks such as HIPAA, SOC 2 and ISO, exposing them to network and data vulnerabilities. Authentic Web plans follow-up benchmark studies on healthcare and other sectors.
Methodology
Authentic Web selected a representative sample of 25 medium to large healthcare providers across the United States. Using DNS Inspector’s domain and DNS discovery, cross-referenced with WHOIS and IT infrastructure data, it identified 9,269 domains used by the sample organizations. It then catalogued the zone file of each domain, capturing about 40,000 resource records (40,789), and scanned them for DNS network vulnerabilities. Steps: (1) domain discovery from the brand, WHOIS and infrastructure; (2) zone discovery of A records, CNAMEs and related records; (3) vulnerability audit of the DNS infrastructure.
Sample profile. The 25 organizations have average revenue of $93B (range $240M to $400B) and average employees of 81,000 (range 2,000 to 440,000). Sub-sectors: 14 hospitals, five insurance companies, four pharmaceutical companies and two technology providers.
Benchmark study scope
| Item | Number | Ratio |
|---|---|---|
| Total domains | 9,269 | 371 domains per entity |
| Total records analyzed | 40,789 | 4.40 records per domain (printed as 6.24) |
| Total A records | 14,807 | 1.6 per domain |
| Total CNAMEs | 5,392 | 0.58 per domain |
| Total redirects | 2,222 | 0.24 per domain |
| SPF records | 4,576 | 0.49 per domain |
| DMARC records | 4,458 (4,468 in the DMARC chart) | 0.48 per domain |
| DNSSEC records | 55 | 0.006 per domain |
- Registrars: the domains are with 91 registrars, and five represent 93% of all domains: Network Solutions, MarkMonitor, CSC, GoDaddy and Corsearch.
- DNS providers: 81 distinct providers, with five representing 72% of domains: Cloudflare, AT&T, CIGNA, NSONE Inc and GoDaddy.
- Top-level domains: concentrated in legacy TLDs, with 60% of domains on .com (5,555 domains, 59.9%).
| TLD type | Domains | TLDs |
|---|---|---|
| Legacy generic | 8,855 | 6 |
| Country codes | 275 | 25 |
| New generics | 139 | 56 |
| Total | 9,269 | 87 |
DNS vulnerabilities explained
The DNS is used in nearly every cyberattack. Because it is a global public network, it exposes enterprise vulnerabilities to any party motivated to look.
| Vulnerability | What it is | How it is used in an attack |
|---|---|---|
| Orphaned IPs | A records pointing to IPs that are not under the control of enterprise infrastructure and monitored by endpoint vulnerability systems. | Losing control of an IP on a shared web service such as AWS creates an attack vector: a third party can take the IP over. |
| Dangling CNAMEs | CNAMEs pointing to a web resource or host not under enterprise control and monitored. | A third party can create the host name the CNAME points to, enabling deployment of any type of attack. |
| Insecure redirects | One or more hops to the destination is unencrypted (HTTP only). | Encryption gaps allow a man-in-the-middle exploit that compromises audiences navigating from origin to destination. |
| Lame delegations | A domain has no Start of Authority (SOA) record set up on the DNS service that governs create and edit control for the domain. | Allows creation of an SOA record on the DNS service that assumes full control of the DNS for that domain. |
| SPF and DMARC coverage and errors | Records do not conform to RFCs, or SPF and DMARC records are missing. | Nonconforming or missing records enable phishing attacks. |
| DNSSEC coverage gaps | DNSSEC is not present or not configured correctly. Some organizations resist it because of perceived key-roll risk. | DNSSEC defends against DNS cache poisoning of recursive servers, which can lead to man-in-the-middle exposure. |
Benchmark vulnerability results
| Check | Result | What it means |
|---|---|---|
| A records (HTTP/HTTPS scan) | 89% pass, 11% exposure | Flags potential vulnerabilities including orphaned IPs, insecure connections and deprecated TLS versions. Some responses may be legacy settings to deprovision or internal-only by design; teams classify each as material or acceptable. |
| Redirects | 83% pass, 17% exposure | Every redirect must be certificate-secured from origin through destination for end-to-end encryption. Other exposures include excessive hops or orphaned records pointing to resources the company no longer controls. |
| CNAMEs | 65% pass, 35% exposure | Dangling CNAMEs are vulnerable to compromise with minimal effort. Teams configure CNAMEs for a purpose, deprovision the destination later and neglect to remove the CNAME. |
| Lame delegations | 83% pass, 17% exposure | Without a valid SOA record, parties can create an illegitimate SOA on the network where the domain is hosted and hijack its zone file. The paper calls 17% “very high” and clear evidence that legacy registrars and domain owners are failing to secure domains. |
| SPF | 4,576 domains pass (49%), 4,616 unprotected (50%), 77 with errors (about 1%) | SPF records define which mail servers may send mail for a domain. Domains without a valid record are exposed to phishing from their own domain. |
| DMARC | 4,468 pass (48%), 4,782 unprotected (52%), 19 with errors | DMARC works with SPF to secure email. Without it across the portfolio, phishing emails can be sent from your own domain. |
| DNSSEC | 1% signed (55 domains), 99% unprotected | DNSSEC signs the zone file cryptographically and prevents DNS-based man-in-the-middle attacks by blocking cache poisoning. Automated key rolling in modern registrar and DNS systems is expected to raise adoption. |
Best practices and benefits of action
- Conduct a DNS security audit to gain visibility and establish your security posture.
- Consolidate domains to a single registrar and DNS provider with change control automation.
- Implement ongoing DNS configuration, security inspection and monitoring.
Benefits: keeps the company and customers safe on branded spaces; complies with infrastructure control requirements in relevant frameworks; automates the practice so teams can get and keep control; and reduces total cost of ownership through consolidation and automation.