Government's 'orphan websites' could be stalling .gov security

More than 18 months after the deadline, the deployment of security protocols on .gov domains apparently has stalled at around 50 percent, government officials said.

Under a 2008 memo from the Office of Management and Budget, Domain Name System Security Extensions (DNSSEC) were to be deployed to all federal systems by December 2009.

“We were at 50 percent last year, we were at 50 percent this year,” Lee Ellis, the .gov program manager for the General Services Administration, said at the FOSE conference in Washington July 20. “Fifty percent DNSSEC signed zones is unacceptable.”

Related stories:

Internet security hits major milestone, as .com signs on 

Internet security quietly reaches a milestone

There are a variety of technical, financial and organizational barriers to completing DNSSEC deployment, Ellis said, but one of the greatest sticking points might be “orphan websites” — outdated or abandoned sites that have been forgotten by their owners.

A recently announced program to clean up the executive branch’s .gov space and consolidate websites could help to improve the DNSSEC percentages, said Andy Ozment, the White House National Security Council’s director for federal information security policy.

“I believe that many domains that are not signed are domains that their owners don’t know about,” Ozment said.

The Domain Name System (DNS) maps Internet domain names, such as gcn.com, to numerical IP addresses and underlies nearly all Internet activities. DNSSEC enables the use of digital signatures that can be used to authenticate DNS data that is returned to query responses. This will help to combat attacks such as pharming, cache poisoning and DNS redirection that are used to misdirect traffic to malicious sites for fraud and the distribution of malware.

“Right now, DNS is a vulnerability in the Internet and we need to fix it,” Ozment said.

That fix is available, but to be fully effective, DNSSEC must be deployed through the Internet’s domains.

Interest in deploying the security protocols was sparked in 2008 with the discovery of a vulnerability that would enable easy exploitation of weaknesses in the Domain Name System. The .gov Top Level Domain was signed in early 2009, and DNSSEC was fully deployed by operators of the Internet’s authoritative root zone in July 2010, providing a trust anchor that now can tie together “islands of trust” that have been created by the deployment of DNSSEC in isolated domains.

Agencies were supposed to deploy it in their domains by the end of 2009, but that deadline is long passed without having been met.

One of the reasons DNSSEC has not been more widely implemented is that “there still is not a lot of customer pull,” said Douglas Maughan, director of the Homeland Security Department’s Cyber Security Division. The government has tried to drive the process by mandating deployment in its own Internet space, but over the past year it has turned out that government has been pulled by the private sector rather than pushing it.

The exact percentage of signed .gov domains is difficult to determine because there is no authoritative number for domains. Ellis said there are about 5,000 domains total in .gov, about 1,900 of them federal. A list ofexecutive branch sites posted on Data.gov lists 1,736 sites.

Sean Donelon, program manager for network and infrastructure security at DHS, said that as of July 5, 16 agencies had digitally signed all of their .gov domains, 24 had signed some, and 67 had not signed any. Some of those that have not completed signing had missed orphan domains they were not aware of, Donelon said.

The Obama administration announced earlier this month a program to reduce the number of federal websites as part of its campaign to cut waste, eliminating duplicative, outdated and unproductive sites. It initially stopped creation of new websites for 90 days and has set a goal of cutting the number of separate, stand-alone sites by half.

“We are reducing the number of those,” said Ellis, who is a member of the .gov Task Force created to manage the culling. How many of those sites are orphans is not known.

Aside from the sheer number of sites, there are a number of other hurdles to full deployment of DNSSEC, which requires not only digitally signing records so that they can be validated, but managing the cryptographic signing keys. Donelon said key problems include:

• Lack of adequate vendor support, although this is changing as vendors move into the market place with more tools and services.
• Technical problems with digital signing and key exchanges because immature standards are not always interoperable.
• Lack of managed DNSSEC solutions from service providers, although these are beginning to appear.
• Infrastructure upgrades needed to support signing in some environments.
• Funding and resources, a perennial problem in any government program.
• Contractual barriers with vendors and subcomponents of agencies.
• Personnel management and training.
• Communication and governance. “We still run into agencies that say ‘we didn’t know we had to do this,’ ” Donelon said.