DNS Threat Intelligence for Higher Education Networks

With IT staff struggling to protect legacy networks on tight budgets, it’s no wonder schools and universities are top targets for cybercriminals. Sprawling campuses handling BYoD and multiple IoT devices, together with frequent ransomware attacks and compliance regulations add to the difficulty. The 2023 IDC Threat Survey found that 90% of institutions each suffer on average 8 DNS attacks per year, with every attack costing $1.15M in damages. The report goes on to provide recommendations on how Higher Ed can evolve to proactive defense using DNS Threat Intelligence, in order to enhance ransomware detection and zero trust.

Why is Higher Education a favorite target?

Universities handle a wealth of personal and research data, intellectual property and other valuable assets. This makes them enticing for state-sponsored actors, as well as cybercriminals looking to monetise stolen material through sale or ransom. Compliance frameworks also complexify security. Many regulations focus on data safety, while others enforce freedom of information.

Institutions are having to handle distance-learning in the midst of the return to in-person learning. The online platforms required for this are often targeted as new entry points into academic networks. At the same time, staff and students connect multiple personal devices to university networks, many of which are outdated or incorrectly patched against known vulnerabilities. Lastly, recent vulnerabilities such as Log4j also opened up institutions to more attacks, affecting websites, apps, devices and digital systems across the campus. 

Sadly, Higher Ed institutions don’t have the same resources as other industries, so have become an easier target.  IT teams are left with few tools and professionals to adequately protect against the rise in frequency and sophistication of cyberattacks. Bad actors have therefore increased breaches such as phishing, malware, ransomware and data theft. Many of these benefit from using DNS as a threat target or vector.

With DNS Attacks on the rise, it’s time to take DNS Security seriously

90% of schools and universities were victims of DNS attacks according to the IDC Threat Report, with damage costs and recovery times being higher than the average across industries. Top attack types included phishing, ransomware, DDoS, and DNS Tunneling (CnC communication/data exfiltration). 

Impacts of DNS attacks proved to be very serious, affecting productivity, brand image and finances. They included:

• Cloud service downtime (46%)
• In-house app downtime (39%)
• Data theft (28%)

In addition, the defenses being used to counteract are inappropriate for ensuring continuity of services. 41% shut down the DNS service, 37% disabled the affected apps, and 26% shut down part of network infrastructure.

IDC Report Highlights: DNS Threat Intelligence enables proactive defense

The IDC report shows that 84% of Higher Ed regard DNS Security as critical for ensuring the security of users, devices, applications, and services. It is viewed as important for the implementation of security concepts such as Threat Intelligence, Zero Trust and Shadow IT. 

Below are some of the key highlights from the report:

DNS Threat Intelligence

• Threat intelligence (TI) has emerged as a pivotal aspect of cybersecurity defense, with 65% of higher education considering it a vital component of their strategy to defend against cyberattacks
• There is a definite need for specialized DNS Threat Intelligence, incorporating DNS Feeds
• For TI, the market sees value of actionable DNS data for:
  • Malware detection – 74%
  • Phishing detection – 77%
  • Ransomware detection – 73%
  • Improved Access Control to apps and data – 51%
• But DNS data is being underutilized – 43% of Higher Ed do not perform any analysis their DNS data, and only 19% use it today for TI

Ransomware

• Average remediation cost for Higher Ed was $1.42M in 2021, with 85% of malware using DNS to develop their attack
• Analysis of DNS traffic helps identify unusual patterns of traffic to unveil zero-day malicious domains used for data exfiltration by ransomware

• Only 47% of Higher Ed use or consider using DNS security for ransomware and malware protection, far below the 54% average across industries
• DNS Filtering can block access to known malicious domains, preventing ransomware from communicating with its CnC servers, thus preventing the attack causing any damage
• DNS Filtering can also be used to block access to known phishing sites, helping prevent initiation of ransomware attacks

Data Theft

• Institutions are challenged with meeting compliance for data protection and data privacy regulations such as GDPR and NIS2
• DNS is a valuable tool for helping organizations achieve regulatory compliance by providing domain filtering, data privacy, logging and analysis, compliance reporting on DNS  traffic, and overall boosted security measure
• DNS strengthens data protection by filling gaps left by traditional security systems
• 53% of Higher Ed say DNS security can help prevent data exfiltration by detecting improper DNS flow and blocking related traffic. Average across all industries is 59%
• Private DNS over HTTPS (DoH) improves data privacy by encrypting DNS traffic and preventing unauthorized access to DNS data

Securing Extended Networks

WIth Higher Education networks having to support connected devices, cloud services/apps, and “work-from-anywhere”, DNS is seen as critical in securing:

• On-prem workforce – 83%
• Remote workforce – 83%
• IoT – 57%
• Cloud – 84%
• Datacenters – 65%

Key Recommendations

1. Leverage DNS threat intelligence feeds to help you evolve to proactive defense
2. Benefit from DNS observability to strengthen your security posture
3. Incorporate DNS data into your security ecosystem to accelerate threat remediation