The Rapid Rise In DNS Attacks Demands New Approaches To Cyber Defense

A staggering 66% of organisations worldwide fell victim to ransomware attacks between March 2022 and March 2023. Many of those incidents involved a DNS (domain name system) attack. Every DNS has weaknesses, and there are several ways that attackers can exploit them.

One popular method is a “DNS flood,” a distributed denial-of-service attack that overwhelms a targeted DNS server. A DNS attack of any kind can do severe damage. It can disrupt online services and create opportunities for attackers to exploit the resulting chaos for further malicious activities, including the insertion of ransomware to encrypt critical data before a ransom demand for the decryption keys.

Misconfigurations in DNS infrastructure can also serve as entry points for ransomware attacks. Cybercriminals exploit these weaknesses to gain unauthorised access to an organisation’s network. Once inside, they can distribute ransomware payloads.

But wait, there’s more. Bad actors can exploit DNS vulnerabilities to execute DNS hijacking attacks. For instance, hackers can take advantage of the DNS system to steer their victims away from the websites they frequent and lead them to imposter sites that appear legitimate. These fake sites can trick victims into entering their login credentials or downloading malicious files. Providing these details can help attackers move laterally within the network or deliver a ransomware payload.

Stepping Up To Zero

As ransomware grows more sophisticated - and DNS attacks become more frequent - organisations are trying to protect themselves by adopting innovative approaches and technologies to bolster the integrity and security of their backup systems. One such approach is “zero trust” security. Zero trust isn’t a single product or technology. It’s a fusion of policies, best practices, and available products.

Zero trust aims to create an environment that offers comprehensive protection against potential threats.

A zero-trust approach enhances the integrity and security of backup systems by fundamentally changing how organisations think about network security. In a traditional security model, once a user or system gains access to a network, they often have broad access privileges, including backup systems. However, with zero trust, a company never assumes trust and enforces security at every level, including backup systems. Thus, the name.

Zero trust follows the principle of least privilege, meaning that the company grants users or systems only the minimum access required to perform their specific tasks. In the context of backup systems, this ensures that only authorised personnel and processes have access to backup data, which reduces the risk of unauthorised access and data breaches.

Zero trust relies on continuous authentication and monitoring. Users and systems are authenticated at the initial login and throughout their session. This approach ensures access remains appropriate, and a company can revoke access when any suspicious activity is detected, preventing unauthorised access. Moreover, a company can promptly identify any unusual behaviour or access patterns and take action to investigate and mitigate potential threats. This real-time monitoring helps safeguard the integrity of all systems—including backup systems.

Focusing On Recovery

The primary goal of any backup strategy should be the ability to recover data effectively when needed. In other words, the focus should not solely be on making backups but on ensuring that a company can restore them to their original state. Often, customers secure their environment, create multiple copies of their data, and store it in various locations, including the cloud. Sounds like a robust backup plan, right? But the real test is in the restoration process.

When data is lost or compromised, the speed and efficiency of data recovery are vital. By prioritising recovery, you minimise downtime—which these days is essential. Data recovery becomes a critical defence mechanism as ransomware and DNS attacks increase. If a company can recover data quickly and effectively, it reduces the leverage that cybercriminals have to demand a ransom.

Does an emphasis on recovery work? The news suggests that it does. Recent reports show that most organisations now recover from backups rather than pay ransom. While this approach doesn’t guarantee 100% data recovery, it is often more cost-effective and helps maintain data integrity. Remember that it depends on a solid backup and recovery strategy.

To recover 100% of your data, you must ensure that your backup procedures are robust, regularly tested, and aligned with evolving data and environment changes.

Customers sometimes struggle with data recovery not because of the backup itself but due to outdated policies that miss essential data or fail to back up correctly. It’s crucial to stay on top of the basics in data protection, especially in the context of evolving threats like ransomware and DNS attacks.

Final Thoughts

I want to finish with a few words on cooperation. Many companies nowadays desperately try to stay one step ahead of the bad guys. But they can’t do it alone. We can’t do it alone. It’s time to consider what companies can accomplish when collaborating and sharing resources. Ironically, it’s the malicious actors who often share their tactics and strategies on the dark web. The good guys need to start banding together, too.

It’s not easy. If your organisation falls victim to an attack, you don’t start posting about it online. You’re reticent to give out details. That’s normal. But if all organisations share more information about attacks, we can help each other and immensely improve global protection against cybercrime.

Mark Johnson is Senior Director of Global Alliances at Arcserve                    Image: metamorworks

You Might Also Read:

Why DNS Protection Should Be A Crucial Part In Building Cyber Defense:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The US Security Standard For IoT Devices
Airline Customer Data Left Exposed For Months »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Cyber Security Academy - University of Southampton

Cyber Security Academy - University of Southampton

An industry/University partnership established to advance cyber security through world class research, teaching excellence, industrial expertise and training capacity.

Capita

Capita

Capita is a consulting, digital services and software business, providing end-to-end enterprise IT services and solutions focused around digital transformation and innovation.

Egerie

Egerie

EGERIE's RiskManager solution provides a Global, Centralized, and Updated view of risk maps and security measures for your company.

CONCERT

CONCERT

CONCERT is a Computer Emergency Response Team and cyber security information sharing network for companies, institutes and government in Korea.

Tigerscheme

Tigerscheme

Tigerscheme is a certification scheme for information security specialists, backed by University standards and covering a wide range of expertise.

CPP Group UK

CPP Group UK

CPP Group UK develops products to help insurers add further value to their products and services through its innovative suite of new products in FinTech, InsurTech and cyber security.

Wynyard Group

Wynyard Group

Wynyard Group is a niche, technology-driven company specializing in Integrated Border Security solutions for enhanced public safety.

StartupXseed Ventures

StartupXseed Ventures

StartupXseed Ventures is a smart capital provider for Deep Tech, B2B, Early Stage Startups. We support, NextGen Tech Entrepreneurs, who have potential to deliver the outsized growth.

Cyolo

Cyolo

Cyolo’s Secure Access Service Edge (SASE) platform securely connects onsite and remote users to authorized assets, in the organizational network, cloud or IoT environments and even offline networks.

Digital Identification & Authentication Council of Canada (DIACC)

Digital Identification & Authentication Council of Canada (DIACC)

DIACC is a non-profit coalition of public and private sector leaders committed to developing a Canadian framework for digital identification and authentication.

BriskInfosec Technology & Consulting

BriskInfosec Technology & Consulting

BriskInfosec provides information security services, products and compliance solutions to our customers.

BrainStorm

BrainStorm

BrainStorm Threat Defense takes a new human-focused approach to security awareness that traditional training lacks. It’s a cutting-edge platform to make your users more security savvy.

European Data Protection Supervisor (EDPS)

European Data Protection Supervisor (EDPS)

The EDPS is the European Union’s independent data protection authority. We monitor and ensure the protection of personal data and privacy when EU institutions and bodies process personal information.

RSK Cyber Security

RSK Cyber Security

RSK Cyber Security are a leading cyber security services company that uses services, consulting, and product knowledge to lower security risk across the board.

Reken

Reken

Reken are building a new type of AI platform and products to protect against generative AI threats.

SKADI Cyber Defense

SKADI Cyber Defense

At SKADI Cyber Defense, we specialize in enterprise-grade cybersecurity solutions tailored for small to medium businesses.