The Rapid Rise In DNS Attacks Demands New Approaches To Cyber Defense

A staggering 66% of organisations worldwide fell victim to ransomware attacks between March 2022 and March 2023. Many of those incidents involved a DNS (domain name system) attack. Every DNS has weaknesses, and there are several ways that attackers can exploit them.

One popular method is a “DNS flood,” a distributed denial-of-service attack that overwhelms a targeted DNS server. A DNS attack of any kind can do severe damage. It can disrupt online services and create opportunities for attackers to exploit the resulting chaos for further malicious activities, including the insertion of ransomware to encrypt critical data before a ransom demand for the decryption keys.

Misconfigurations in DNS infrastructure can also serve as entry points for ransomware attacks. Cybercriminals exploit these weaknesses to gain unauthorised access to an organisation’s network. Once inside, they can distribute ransomware payloads.

But wait, there’s more. Bad actors can exploit DNS vulnerabilities to execute DNS hijacking attacks. For instance, hackers can take advantage of the DNS system to steer their victims away from the websites they frequent and lead them to imposter sites that appear legitimate. These fake sites can trick victims into entering their login credentials or downloading malicious files. Providing these details can help attackers move laterally within the network or deliver a ransomware payload.

Stepping Up To Zero

As ransomware grows more sophisticated - and DNS attacks become more frequent - organisations are trying to protect themselves by adopting innovative approaches and technologies to bolster the integrity and security of their backup systems. One such approach is “zero trust” security. Zero trust isn’t a single product or technology. It’s a fusion of policies, best practices, and available products.

Zero trust aims to create an environment that offers comprehensive protection against potential threats.

A zero-trust approach enhances the integrity and security of backup systems by fundamentally changing how organisations think about network security. In a traditional security model, once a user or system gains access to a network, they often have broad access privileges, including backup systems. However, with zero trust, a company never assumes trust and enforces security at every level, including backup systems. Thus, the name.

Zero trust follows the principle of least privilege, meaning that the company grants users or systems only the minimum access required to perform their specific tasks. In the context of backup systems, this ensures that only authorised personnel and processes have access to backup data, which reduces the risk of unauthorised access and data breaches.

Zero trust relies on continuous authentication and monitoring. Users and systems are authenticated at the initial login and throughout their session. This approach ensures access remains appropriate, and a company can revoke access when any suspicious activity is detected, preventing unauthorised access. Moreover, a company can promptly identify any unusual behaviour or access patterns and take action to investigate and mitigate potential threats. This real-time monitoring helps safeguard the integrity of all systems—including backup systems.

Focusing On Recovery

The primary goal of any backup strategy should be the ability to recover data effectively when needed. In other words, the focus should not solely be on making backups but on ensuring that a company can restore them to their original state. Often, customers secure their environment, create multiple copies of their data, and store it in various locations, including the cloud. Sounds like a robust backup plan, right? But the real test is in the restoration process.

When data is lost or compromised, the speed and efficiency of data recovery are vital. By prioritising recovery, you minimise downtime—which these days is essential. Data recovery becomes a critical defence mechanism as ransomware and DNS attacks increase. If a company can recover data quickly and effectively, it reduces the leverage that cybercriminals have to demand a ransom.

Does an emphasis on recovery work? The news suggests that it does. Recent reports show that most organisations now recover from backups rather than pay ransom. While this approach doesn’t guarantee 100% data recovery, it is often more cost-effective and helps maintain data integrity. Remember that it depends on a solid backup and recovery strategy.

To recover 100% of your data, you must ensure that your backup procedures are robust, regularly tested, and aligned with evolving data and environment changes.

Customers sometimes struggle with data recovery not because of the backup itself but due to outdated policies that miss essential data or fail to back up correctly. It’s crucial to stay on top of the basics in data protection, especially in the context of evolving threats like ransomware and DNS attacks.

Final Thoughts

I want to finish with a few words on cooperation. Many companies nowadays desperately try to stay one step ahead of the bad guys. But they can’t do it alone. We can’t do it alone. It’s time to consider what companies can accomplish when collaborating and sharing resources. Ironically, it’s the malicious actors who often share their tactics and strategies on the dark web. The good guys need to start banding together, too.

It’s not easy. If your organisation falls victim to an attack, you don’t start posting about it online. You’re reticent to give out details. That’s normal. But if all organisations share more information about attacks, we can help each other and immensely improve global protection against cybercrime.

Mark Johnson is Senior Director of Global Alliances at Arcserve                    Image: metamorworks

You Might Also Read:

Why DNS Protection Should Be A Crucial Part In Building Cyber Defense:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The US Security Standard For IoT Devices
Airline Customer Data Left Exposed For Months »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Tendo Solutions

Tendo Solutions

Tendo Solutions provides intelligence, security, forensics and risk solutions to clients across different sectors and jurisdictions.

CloudCheckr

CloudCheckr

CloudCheckr is a next-gen cloud management platform that unifies Security & Compliance, Inventory & Utilization and Cost Management.

Protection Group International (PGI)

Protection Group International (PGI)

PGI helps organisations and governments to manage digital risk. From cyber security services to business intelligence, we help reduce the risks to your finances, reputation, assets and people.

Sintef Digital

Sintef Digital

Sintef Digital carries out research in Information and Communication Technology for industry and the public sector.

HYPR

HYPR

HYPR Decentralized Authentication minimizes the risk of enterprise data breaches while providing an enhanced user experience for your customers and employees.

ATIS Systems

ATIS Systems

ATIS Systems offers first-class complete solutions for legal interception, mediation, data retention, and IT forensics.

Infortec

Infortec

Infortec provide consultancy and solutions for the protection of digital information and the management of computer resources.

LuJam Cyber

LuJam Cyber

LuJam Cyber is a cybersecurity company that provides protection to SME Networks.

Braintrace

Braintrace

Braintrace’s services include Managed Detection and Response (MDR), Managed SIEM, SIEM-as-a-Service, SOC-as-a-Service, Advisory Services, and Incident Response.

CPP Group UK

CPP Group UK

CPP Group UK develops products to help insurers add further value to their products and services through its innovative suite of new products in FinTech, InsurTech and cyber security.

White & Black

White & Black

White & Black are specialist corporate & technology lawyers based in London & Oxford.

Penten

Penten

Penten is an Australian-based cyber security company focused on innovation in secure mobility and applied AI (artificial intelligence).

Salvador Technologies

Salvador Technologies

Salvador Technologies provides the world’s fastest technology to recover from cyber-attacks.

Virtue Security

Virtue Security

Virtue Security are specialists in web application penetration testing.

NANO Corp

NANO Corp

At NANO Corp, we keep your network visible, understandable, operational and secure with state-of-the-art technology.

Forthright Technology Partners

Forthright Technology Partners

Forthright Technology Partners (Forthright) is a next-generation cloud and managed IT services provider serving a global clientele.