Cyberstudy
PDF p.289 In progress

DNS Filtering

Open PDF at p.289 21 flashcards

Summary

PDF p.289

DNS filtering blocks or allows access to specific websites by controlling the resolution of domain names into IP addresses. It provides a proactive defense against malicious sites, enforces acceptable use policies, and protects all devices on a network. DNS filtering is easy to implement and cost-effective but should be combined with other security measures for comprehensive protection.

In plain words

Supplementary — not from your PDF

DNS filtering blocks access to malicious or unwanted domains by refusing to resolve them. It protects every device that uses the resolver, including IoT. Options include filtering services (Quad9, OpenDNS, CleanBrowsing), your own DNS servers, DNS firewalls, endpoint agents, or Pi-hole. Secure the DNS itself too: make it fault-tolerant, allow recursion only for internal hosts, patch it, block unauthorized zone transfers, and use DNSSEC against spoofing and poisoning.

Detailed explanation

PDF p.289

DNS Filtering Basics

  • Function: Controls access to websites by managing the resolution of domain names into IP addresses.
  • Mechanism: Checks domain name requests against a database of approved or blocked domains. Blocks access to malicious or unapproved sites.

Benefits of DNS Filtering

  • Proactive Defense: Blocks access to phishing sites, malware distribution sites, and other malicious destinations.
  • Policy Enforcement: Helps enforce acceptable use policies by blocking inappropriate or distracting websites.
  • Device Protection: Protects all devices on a network, including IoT devices.
  • Ease of Implementation: Simple to set up and cost-effective for networks of any size.

Implementing DNS Filtering

  • DNS Filtering Services: Use services like Cisco's OpenDNS, Quad9, or CleanBrowsing for DNS resolution with built-in filtering.
  • Managed DNS Servers: Organizations can implement DNS filtering directly on their own DNS servers (e.g., Microsoft's DNS server or BIND) for complete control over filtering policies.
  • DNS Firewalls: Intercept DNS queries at the network level and apply filtering rules.
  • Endpoint Protection: Some antivirus software and endpoint protection tools provide DNS filtering capabilities for device-level protection.
  • Open Source Solutions: Tools like Pi-hole or ADGuard can be configured as local DNS resolvers with filtering capabilities, often implemented on Raspberry Pi hardware.

DNS Security

  • Fault Tolerance: Ensure DNS services are fault-tolerant to prevent disruptions from DoS attacks.
  • Access Control: Local DNS servers should only accept recursive queries from authenticated local hosts and not from the Internet.
  • Patch Management: Regularly update DNS server software to address known vulnerabilities.
  • Preventing DNS Footprinting: Use access control lists to prevent unauthorized zone transfers and protect private network information.
  • DNSSEC (DNS Security Extensions): Mitigates spoofing and poisoning attacks by validating DNS responses with signed resource records.

Important terms

taken from the text above
Proactive Defense
Blocks access to phishing sites, malware distribution sites, and other malicious destinations.
Policy Enforcement
Helps enforce acceptable use policies by blocking inappropriate or distracting websites.
Device Protection
Protects all devices on a network, including IoT devices.
Ease of Implementation
Simple to set up and cost-effective for networks of any size.
DNS Filtering Services
Use services like Cisco's OpenDNS, Quad9, or CleanBrowsing for DNS resolution with built-in filtering.
Managed DNS Servers
Organizations can implement DNS filtering directly on their own DNS servers (e.g., Microsoft's DNS server or BIND) for complete control over filtering policies.
DNS Firewalls
Intercept DNS queries at the network level and apply filtering rules.
Endpoint Protection
Some antivirus software and endpoint protection tools provide DNS filtering capabilities for device-level protection.
Open Source Solutions
Tools like Pi-hole or ADGuard can be configured as local DNS resolvers with filtering capabilities, often implemented on Raspberry Pi hardware.
Fault Tolerance
Ensure DNS services are fault-tolerant to prevent disruptions from DoS attacks.
Access Control
Local DNS servers should only accept recursive queries from authenticated local hosts and not from the Internet.
Patch Management
Regularly update DNS server software to address known vulnerabilities.
Preventing DNS Footprinting
Use access control lists to prevent unauthorized zone transfers and protect private network information.
DNSSEC (DNS Security Extensions)
Mitigates spoofing and poisoning attacks by validating DNS responses with signed resource records.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Pointing a home network at Quad9 to block known-malicious domains.
  • Restricting zone transfers to secondary DNS servers only.
  • Enabling DNSSEC validation on resolvers.

Scenario

A user clicks a phishing link, but the domain is on the DNS filter's block list, so it never resolves and the page doesn't load. The attack is stopped before any content is downloaded.

Common mistakes

Supplementary — not from your PDF
  • Relying on DNS filtering alone. Direct IP connections bypass it.
  • Allowing open recursion from the Internet on your DNS servers.

Practical skills

Supplementary — not from your PDF
  • Set up DNS filtering for your own home network.
  • List DNS server hardening steps.

What I should remember

Key Points PDF p.289
  • DNS Filtering Basics
    • Function: Controls website access.
    • Mechanism: Checks domain requests against a database.
  • Benefits
    • Proactive Defense: Blocks malicious sites.
    • Policy Enforcement: Enforces acceptable use policies.
    • Device Protection: Protects all network devices.
    • Ease of Implementation: Simple and cost-effective.
  • Implementing DNS Filtering
    • Services: OpenDNS, Quad9, CleanBrowsing.
    • Managed Servers: Microsoft's DNS server, BIND.
    • DNS Firewalls: Network-level filtering.
    • Endpoint Protection: Device-level filtering.
    • Open Source: Pi-hole, ADGuard.
  • DNS Security
    • Fault Tolerance: Prevent DoS disruptions.
    • Access Control: Restrict recursive queries.
    • Patch Management: Update server software.
    • Preventing Footprinting: Use access control lists.
    • DNSSEC: Validates DNS responses.