Keep DNS Protected With Actionable Security Insight

Understanding DNS traffic

Can you be sure your business isn’t experiencing a DNS attack right now?

In this post, I’ll discuss how insight into your DNS keeps your business secure, optimizes your DNS performance, and helps you stay on top of new DNS vulnerabilities.

In previous posts, I’ve talked about DNS planning and rate limiting to protect your DNS infrastructure. Now, however, I tell you how you can inspect everything that gets processed by your DNS, enabling you to see irregularities and avert attacks. The results of such a traffic examination, I like to call insight. The tools I’ll discuss today help you understand what’s going on with your DNS infrastructure.

DNS traffic insight for proactive protection

When your DNS infrastructure is under attack, quick action is important. You need a tool that helps scrutinize malicious traffic. The new CloudShield DNS Defender Management Analytics (DMA) tool does exactly that. Its DNS GUI provides insight into your DNS traffic, including the blocking, filtering, and redirecting in real-time. DMA is included with DNS Defender v3.0 and is available separately as well.

DMA makes it easy to gain DNS insight. Just add DMA to your threat operations center (SOC or NOC) to monitor alerts and DNS information on the same screen. The screen shot below shows what the DMA dashboard looks like; you can see client queries, dropped traffic, the performance of the DNS Defender fast cache, and server responses. You can customize the DMA dashboard to your preferences.

The dashboard in the SOC or NOC gives enough information to perceive traffic abnormalities that might indicate an attack, failing equipment, or other DNS irregularities that require further examination.

I think we’ve made analysis easy with DMA. In its role as the only real-time DNS GUI, DMA lets you look at an overview of all events seen by DNS Defender, or click a graphic for details on individual packets. It displays the IP address, location, size, and more (see screenshot below). Monitoring and understanding traffic with DMA helps protect your DNS infrastructure from attacks and enables you to take action to mitigate their effects.

Visualizing an optimized DNS infrastructure

DNS infrastructure is expensive to operate. DMA can help you understand traffic patterns so you know when you really need to add another DNS server. You might uncover illegitimate packets that bog down your servers. DMA also shows the performance of the DNS Defender name cache.

Flexibility for quick action

Often customers ask us to help them stop a DNS attack. Depending on the complexity of their environment, it might take us only a few hours to identify the characteristics of an attack before we can develop a solution. We use DMA to inspect malicious traffic, understand what’s going on, and write customized patches or programs on the fly. The open architecture of DNS Defender allows us to add the patches or programs without new hardware or software upgrades.

Save cost and headaches with actionable DNS security insight

I’ve received calls from businesses after they’ve suffered a DNS attack. Some of them have lost revenue, or customers, or both. We help them ensure their future with DNS Defender and DMA. The new insight we provide with DMA can help stop the next attack sooner and prevent losses.

Let me know in the comments what you think! I can show you CloudShield DMA live on request.