How agencies can protect themselves against DNS attacks
Connecting state and local government leaders
Government must segment their network architecture and adopt a zero-trust strategy.
At the end of 2019, Pensacola, Fla., city government shut down its entire network after being hit by a cyberattack -- the whole network. Online payments, emails, phones and other services, including 311 customer service lines, went dark. This was moderate compared to the attacks that crippled multiple Louisiana state agencies in November. That incident was the second largest digital assault the state suffered in the last six months, and it forced the governor to declare a state of emergency.
For attackers, crippling agency operations is one objective, but it’s not the only one. Cybercriminals want to catch big fish -- personal data including bank account details and Social Security numbers. As government agencies increasingly rely on online services at both the state and federal levels, the risk becomes progressively greater that data will be stolen. Recent incidents are evidence of the trend. Ransomware attacks hit the Baltimore and Atlanta city governments in the last year, and almost two dozen small Texas towns were targeted.
A recent study in collaboration with IDC revealed that governments are essentially sleepwalking into millions of dollars in DNS cyberattack damages each year. It’s one of the most popular vectors for attacks, and cybercriminals know it. The domain name system is a gateway into any network, making it an obvious target. Last year, each DNS attach on government organizations cost an average of $558,000.
When breached, most agencies are forced to shut down entire networks. According to the report, it’s in-house applications (51%) that suffer the most -- rendering many vital services useless. Compromised websites -- which many local residents use to pay bills, fines or purchase permits -- were affected almost half of the time (41%), and one in five governments reported the theft of intellectual property or sensitive data.
These results may seem bad, but the time to discover and then remediate the attack is worse. Most organizations took over seven hours -- a full business day -- to notice, fix and mitigate an attack, indicating countermeasures were not in place to ensure service continuity. This leaves the door wide open to a huge loss of sensitive personal or financial data.
Take charge of the situation with DNS traffic analysis
Despite the risk, one-third (32%) of government organizations do not recognize the critical nature of DNS to operations. Many reported that DNS security is considered a low or only moderately important priority.
Agencies must rethink their cybersecurity policies to factor in DNS traffic. In particular, they should start by conducting detailed analysis of traffic patterns, such as data exfiltration via DNS. Solutions exist that agencies can to assess any trends.
In the IDC survey, government and the health care sector tied in putting the least importance on machine learning for detecting unknown malicious domains or domain generation algorithms. Government also had the lowest rate of adoption for the zero-trust cybersecurity approach of any sector surveyed.
Look to zero trust
Agencies must learn how to contain risks. Reliable services, availability, bandwidth and control -- all elements crucial to network integrity -- are critical. Disaster recovery and avoiding single points of failure must be part of the mitigation process. This is where adopting a zero-trust strategy is critical.
Perimeter security, long considered the solution, is not enough. Today’s threats come from inside of the network, often in the form of malware and phishing invitations. All it takes is one employee to click a nefarious link, and the doors open to the perpetrator. To stop the spread of threats, agencies must scale down their network architecture into tiny segments, sometimes as small as a single client or server. The principle behind this segmentation strategy is that everything is treated as a threat by default. When user behavior is analyzed at a granular level, menacing patterns in network traffic can be detected. It allows administrators to know what is going on, where, in real-time -- something key to zero trust.
Today, almost all internet connections are initiated through DNS. Cybercriminals aren’t going away anytime soon; they are just becoming more sophisticated. And government agencies in particular, must step up and better secure their networks before they are the next ones to call for a state of emergency.
NEXT STORY: 3 simple solutions to guard against ransomware