The Rapid Rise In DNS Attacks Demands New Approaches To Cyber Defense

A staggering 66% of organisations worldwide fell victim to ransomware attacks between March 2022 and March 2023. Many of those incidents involved a DNS (domain name system) attack. Every DNS has weaknesses, and there are several ways that attackers can exploit them.

One popular method is a “DNS flood,” a distributed denial-of-service attack that overwhelms a targeted DNS server. A DNS attack of any kind can do severe damage. It can disrupt online services and create opportunities for attackers to exploit the resulting chaos for further malicious activities, including the insertion of ransomware to encrypt critical data before a ransom demand for the decryption keys.

Misconfigurations in DNS infrastructure can also serve as entry points for ransomware attacks. Cybercriminals exploit these weaknesses to gain unauthorised access to an organisation’s network. Once inside, they can distribute ransomware payloads.

But wait, there’s more. Bad actors can exploit DNS vulnerabilities to execute DNS hijacking attacks. For instance, hackers can take advantage of the DNS system to steer their victims away from the websites they frequent and lead them to imposter sites that appear legitimate. These fake sites can trick victims into entering their login credentials or downloading malicious files. Providing these details can help attackers move laterally within the network or deliver a ransomware payload.

Stepping Up To Zero

As ransomware grows more sophisticated - and DNS attacks become more frequent - organisations are trying to protect themselves by adopting innovative approaches and technologies to bolster the integrity and security of their backup systems. One such approach is “zero trust” security. Zero trust isn’t a single product or technology. It’s a fusion of policies, best practices, and available products.

Zero trust aims to create an environment that offers comprehensive protection against potential threats.

A zero-trust approach enhances the integrity and security of backup systems by fundamentally changing how organisations think about network security. In a traditional security model, once a user or system gains access to a network, they often have broad access privileges, including backup systems. However, with zero trust, a company never assumes trust and enforces security at every level, including backup systems. Thus, the name.

Zero trust follows the principle of least privilege, meaning that the company grants users or systems only the minimum access required to perform their specific tasks. In the context of backup systems, this ensures that only authorised personnel and processes have access to backup data, which reduces the risk of unauthorised access and data breaches.

Zero trust relies on continuous authentication and monitoring. Users and systems are authenticated at the initial login and throughout their session. This approach ensures access remains appropriate, and a company can revoke access when any suspicious activity is detected, preventing unauthorised access. Moreover, a company can promptly identify any unusual behaviour or access patterns and take action to investigate and mitigate potential threats. This real-time monitoring helps safeguard the integrity of all systems—including backup systems.

Focusing On Recovery

The primary goal of any backup strategy should be the ability to recover data effectively when needed. In other words, the focus should not solely be on making backups but on ensuring that a company can restore them to their original state. Often, customers secure their environment, create multiple copies of their data, and store it in various locations, including the cloud. Sounds like a robust backup plan, right? But the real test is in the restoration process.

When data is lost or compromised, the speed and efficiency of data recovery are vital. By prioritising recovery, you minimise downtime—which these days is essential. Data recovery becomes a critical defence mechanism as ransomware and DNS attacks increase. If a company can recover data quickly and effectively, it reduces the leverage that cybercriminals have to demand a ransom.

Does an emphasis on recovery work? The news suggests that it does. Recent reports show that most organisations now recover from backups rather than pay ransom. While this approach doesn’t guarantee 100% data recovery, it is often more cost-effective and helps maintain data integrity. Remember that it depends on a solid backup and recovery strategy.

To recover 100% of your data, you must ensure that your backup procedures are robust, regularly tested, and aligned with evolving data and environment changes.

Customers sometimes struggle with data recovery not because of the backup itself but due to outdated policies that miss essential data or fail to back up correctly. It’s crucial to stay on top of the basics in data protection, especially in the context of evolving threats like ransomware and DNS attacks.

Final Thoughts

I want to finish with a few words on cooperation. Many companies nowadays desperately try to stay one step ahead of the bad guys. But they can’t do it alone. We can’t do it alone. It’s time to consider what companies can accomplish when collaborating and sharing resources. Ironically, it’s the malicious actors who often share their tactics and strategies on the dark web. The good guys need to start banding together, too.

It’s not easy. If your organisation falls victim to an attack, you don’t start posting about it online. You’re reticent to give out details. That’s normal. But if all organisations share more information about attacks, we can help each other and immensely improve global protection against cybercrime.

Mark Johnson is Senior Director of Global Alliances at Arcserve                    Image: metamorworks

You Might Also Read:

Why DNS Protection Should Be A Crucial Part In Building Cyber Defense:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The US Security Standard For IoT Devices
Airline Customer Data Left Exposed For Months »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Continuity Shop

Continuity Shop

Continuity Shop provides training and consultancy in Business Continuity and Information Security to some of the world's biggest organisations.

Celestix Networks

Celestix Networks

Celestix is a global provider of secure network solutions that enable the simple deployment of secure remote access connectivity.

SBS CyberSecurity

SBS CyberSecurity

SBS CyberSecurity is a premier cybersecurity consulting and audit firm.

Horangi

Horangi

Horangi provides security products and services that enable the rapid delivery of Incident Response and threat detection for our customers who lack the scale, expertise, or time to do it themselves.

SPARTA Consortium

SPARTA Consortium

SPARTA tackles hard innovation challenges, leading the way in building transformative capabilities and forming a world-leading cybersecurity competence network across the EU.

Octane OC

Octane OC

OCTANe is building the SoCal of tomorrow. We drive innovation and growth by connecting people, resources and capital. Our Incubator focus is FinTech, Data Analytics and Cybersecurity.

Connectria

Connectria

Connectria provides cloud hosting, remote monitoring, and compliant cloud security solutions and services to enterprises, medium and small businesses.

Sovereign Intelligence

Sovereign Intelligence

Sovereign Intelligence provides automated insight into the relative intensity of hidden Cyber, Brand, and Financial Risks to your company.

Internetwork Defense (IND)

Internetwork Defense (IND)

Internetwork Defense is a premier provider of Information Security Training and Business Consulting Services in the Mid-Atlantic region.

UST

UST

UST is a global provider of digital technology and transformation, IT services and solutions including managed security services.

Noerr

Noerr

Noerr is one of the top European law firms with 500 professionals in Germany, Europe and the USA. We provide solutions to complex and sophisticated legal matters including cyber risks.

Peris.ai

Peris.ai

Peris.ai is a cybersecurity as a service startup that protects businesses and organizations from online threats.

Somerville

Somerville

Somerville are a full service IT partner with over 40 years experience delivering exceptional service and value to our customers.

ClearSky Cyber Security

ClearSky Cyber Security

ClearSky cyber security provides cyber solutions, focused on threat intelligence services, mainly for the financial sector, critical infrastructure, public sector and the pharma sector.

Everfox

Everfox

Everfox (formerly Forcepoint Federal) has been defending the world's most critical data and networks against the most complex cyber threats imaginable for more than 25 years.

Capzul

Capzul

Capzul are transforming the network security landscape with a new approach; creating virtually impenetrable networks, precluding cybercriminal attacks on your network ecosystem.