Internet Initiative Japan Inc. · TSE:3774
Internet Initiative Japan — Internet Systems Consortium — Technical Presentation (March 2011)
10 slides from Internet Initiative Japan's technical presentation, Mar 1, 2011
Slide 1: DNS Response Policy Zone (DNS RPZ)
DNS Response Policy Zone (DNS RPZ)
Slide 2: DNS Response Policy Zone (DNS RPZ)
DNS Response Policy Zone (DNS RPZ) • DNS RPZ is policy information inside a specially constructed DNS zone. • This enables DNS reputation data producers and consumers to cooperate in the application of such policy to real time DNS responses. • DNS RPZ turns the recursive DNS server into a security h
Slide 3: Core DNS Principles
Core DNS Principles .org Master/ Who is in charge of isc.org? Primary DNS isc.org www.isc.org AXFR TSIG TSIG IXFR www.isc.org is 149.20.64.42 Caching Slave/ Resolver Secondary DNS DNS What is the IP for www.isc.org? AXFR - Full Zone Transfers IXFR - Incremental Zone Transfers TSIG - Transaction SIGn
Slide 4: DNS RPZ
DNS RPZ Security Company .org Master DNS Who is in charge of isc.org? RPZ isc.org AXF R IXFR www.isc.org RPZ www.isc.org is 149.20.64.42 Caching Resolver DNS RPZ capability on the DNS Cashing Resolver allows zone transfers to What is the IP for www.isc.org? be pushed out in seconds.
Slide 5: DNS RPZ in Action
DNS RPZ in Action Intel to find Security Company the badness xyzbadness.com Master DNS RPZ AXF R IXFR RPZ Caching Resolver DNS What is the IP for xyzbadness.com? What is the IP for xyzbadness.com? SPAM Computer looks up Xyzbadness. com
Slide 6: Possible DNS RPZ Uses
Possible DNS RPZ Uses • Block or redirect malicious drop sites (DNS used by URLs) • Block ability of C&C to find its way back using DNS • Walled garden notification for infected clients • Services that use PTR lookups (IP reputation can map into here)
Slide 7: DNS RPZ & SURBL
DNS RPZ & SURBL • What is SURBL RPZ? SURBL RPZ is a version of SURBL's high-quality anti-spam, anti-phishing and anti-malware data in the form of a DNS Response Policy Zone (DNS RPZ). DNS RPZs are used to deny or modify the resolution of low-reputation domains, in other words, to deny DNS services
Slide 8: DNS RPZ Uptake/Concerns?
DNS RPZ Uptake/Concerns? • Pre-announced to usual DNSBL suspects – positive feedback • Administrators can manage their own local RPZ and combine it with other zone feeds. • New markets & ecosystem for security vendors. • Are we teaching bad guys to not use DNS?
Slide 9: ISC's Role with DNS RPZ
ISC’s Role with DNS RPZ • ISC has three roles with DNS RPZ as a new “hammer” in our security toolkit: Code and Functionality in BIND & working with all DNS Recursive Resolver Software Vendors to insure everyone is adopting the same formats. Work with all potential Black List Providers. Work wi
Slide 10: Links
Links • Discussion List • https://lists.isc.org/mailman/listinfo/dnsrpz-interest • Taking back the DNS, Paul Vixie, 29th July 2010 • http://www.isc.org/community/blog/201007/taking- back-dns-0 • Google “taking back the dns” • Draft Specification • ftp://ftp.isc.org/isc/dnsrpz/isc-tn-2010-1.txt • BIN
Internet Systems Consortium — Technical Presentation (March 2011) on 6ix