Internet Initiative Japan Inc. · TSE:3774
Internet Initiative Japan — Internet Identity (IID) — Technical Presentation (June 2012)
31 slides from Internet Initiative Japan's technical presentation, Jun 26, 2012
Slide 1: DNS Firewalls with BIND: ISC RPZ and the IID Approach
DNS Firewalls with BIND: ISC RPZ and the IID Approach Tuesday, 26 June 2012 1
Slide 2: About the Presenters
About the Presenters » » » Paul Vixie Rod Rasmussen Chairman and Founder President and CTO Internet Systems Consortium IID (Internet Identity) 2
Slide 3: Logistics
Logistics • Webinar is 1 hour long • A recording will available in 3 business days at http://www.isc.org/webinars • Participants are muted • Use the Q&A Tab to submit questions 3
Slide 4: Agenda
Agenda • Building DNS Firewalls with RPZ – Paul Vixie • DNS Firewall – Rod Rasmussen • Q&A Session 4
Slide 5: Building DNS Firewalls With RPZ
Building DNS Firewalls With RPZ Paul Vixie Internet Systems Consortium 5
Slide 6: DNS firewalls
DNS firewalls • A DNS firewall examines responses to queries, passes some, blocks others. • Responses can be “examined” for any content. • “Block” action can discard, modify, or replace the original response. 6
Slide 7: The hard part
The hard part • The essence of a DNS firewall is simple. • What’s hard? Maintenance. • How to provide the data that guides its behavior? • How to update that data easily? • How to share that data with others? 7
Slide 8: More about RPZ
More about RPZ • DNS firewall rules carried inside DNS zones. • Rules published, subscribed, shared by normal DNS zone transfer protocol – Including IXFR, NOTIFY, TSIG. – So, propagation is timely, efficient, and authentic. 8
Slide 9: RPZ inspection capabilities
RPZ inspection capabilities • If the name being looked up is X. • If the response contains any IP address in range X. • If a listed name server name is X. • If any returned name server IP address is in range X. 9
Slide 10: RPZ action capabilities
RPZ action capabilities • Synthesize NXDOMAIN. • Synthesize CNAME. • Synthesize NODATA. • Synthesize an answer. • Answer with the truth. 10
Slide 11: Implications
Implications • Controlled Balkanization. • Open market for (many) producers and (many) consumers. • Differentiated service at a global scale. • Instantaneous takedown. 11
Slide 12: Status
Status • RPZ is open and unencumbered. • Implemented only in BIND (so far). • Performance reasonable (~15%). • New features backward compatible. • ISC standard not an IETF standard. • We hope for other implementations. 12
Slide 13: DNS Firewalls
DNS Firewalls Rod Rasmussen IID (Internet Identity) President and CTO 13
Slide 14: Critical Internet Security Problems
Critical Internet Security Problems • Malware command-and-control • Malware infection sites • APT attacks • Phishing and spear phishing 14
Slide 15: Solution
Solution • DNS Firewall • Over 80% of malware uses DNS to communicate. Using a DNS firewall is an easy way to stop this. • Network professionals and security pros working together for mutual benefit 15
Slide 16: Leverages big data on Internet security events
• Leverages “big data” on Internet security events to create intelligence that prevents enterprise employee and system connections to known malicious Internet locations • IID identifies and takes down thousands of malicious Internet locations a week • Brings in data feeds and works with hundreds of
Slide 17: Collective Intelligence
Collective Intelligence • Latest actionable intelligence on malicious Internet locations • Share findings from unique customer relationships – one of the best networks around • Aggregates many of the most robust threat intelligence streams in the industry 17
Slide 18: Feed Delivery
Feed Delivery • Real-time threat updates via RPZ push capability • Daily pre-determined malicious domains • Feed empowers your own DNS infrastructure to provide robust security network wide with no new overhead 18
Slide 19: TrapTrace
TrapTrace • RPZ redirection enables enterprise security personnel to instantly be notified when a compromised machine tries to: • Access a command-and-control server • Transmit sensitive data to a known drop zone • Connect to spear phishing site 19
Slide 20: TrapTrace
TRAPTRACE “@ a _ RESOLVER EMAIL SENT
Slide 21: TrapTrace
TRAPTRACE “@ a _. RESOLVER WEBSITE REQUEST
Slide 22: TrapTrace
TRAPTRACE “@ a _ RESOLVER ay VIDEO
Slide 23: TrapTrace
TRAPTRACE SERVER PC #4 rs May 2, 2011 05:32:44 bad.host.com Known Spear Phishing Domain : Probable User Attack ACTIVETRUST RESOLVER “isa ‘WEBSITE REQUEST
Slide 24: TrapTrace
TRAPTRACE SERVER PC #5 rs May 2, 2011 05:32:44 bad.host.com Known Malware C&C : Probable Infection ACTIVETRUST RESOLVER SURREPTITIOUS MALWARE COMMUNICATIONS BLOCKED
Slide 25: Use Cases: Malware and APT Attacks
Use Cases: Malware and APT Attacks • Malware command-and-control • APT attacks 25
Slide 26: Summary
Summary • Over 80% of malware uses DNS to communicate. Using a DNS firewall is an easy way to stop this. • IID provides solution with actionable intelligence via RPZ feeds and unique TrapTrace feature • By bridging gap between network administrators and security professionals, DNS firewalls are prot
Slide 27: Take Action
Take Action • Go to www.internetidentity.com/solutions/ activetrust-resolver • Email dnsfirewall@internetidentity.com 27
Slide 28: Questions
Questions
Slide 29: About IID
About IID Trust IID to proactively protect against the latest cyber threats: • Five of the top six banks in the U.S. • Largest government agencies worldwide • Leading financial services firms, e-commerce, social networking and ISP companies Headquartered in Tacoma, Washington www.internetidentity.co
Slide 30: About ISC
About ISC • Non-profit dedicated to Internet infrastructure • Software: BIND9, (BIND10,) ISC DHCP, … • Operations: F-Root, Hosted@ISC, … • Protocols: about two dozen IETF RFC’s • Policy: Internet governance (e.g., SOPA) • Commercial services: – support, training, feature development – registry servi
Slide 31: ISC and IID contact details
• ISC • IID • www.isc.org • www.internetidentity.com • info@isc.org • info@internetidentity.com • +1 650 423 1300 • +1 253 590 4100 31
Internet Identity (IID) — Technical Presentation (June 2012) on 6ix