May 25th 2018 is imminent: Are you ready for GDPR?

Officially on May 25, 2018, the General Data Protection Regulation (GDPR) will protect data related to citizens of the European Union, anywhere in the world. It adds strict rules for breaches and possible penalties of up to four percent of turnover and requires notification to the supervisory authority within 72 hours of breach occurring. The regulation has been framed around the location of the data subject, rather than the data controller or data processor, meaning this EU regulation has global impact.

Why is DNS security important for GDPR?

When it comes to GDPR compliance, the Domain Name System (DNS) security can be a friend or foe. Often a neglected area of cyber security strategies, DNS can be an accidental backdoor for hackers to exfiltrate data.

According to our latest Global DNS Threat Survey Report, 29% of organizations experienced Data Exfiltration via DNS. Of those, 16% had sensitive customer information stolen and 15% intellectual property stolen. This could be social security numbers, confidential assignments or even bank details. Yet, how many of those attacks were made public? Very few, if any. A breach of GDPR will make those attacks reach public ears creating a woeful amount of brand damage. Just ask Equifax how that feels.

How data is exfiltrated via DNS

Data loss prevention tools and next generation firewalls lock down the easiest routes out of your network. This forces attackers to explore and experiment with other protocols and take advantage of those, like DNS, that aren’t blocked by traditional security tooling. Exfiltrated data can be easily hidden amongst the normal operations of a DNS service. All internet services use DNS, which means that most DNS servers are constantly busy. Requests used for DNS data exfiltration often go unnoticed as they are blended in with the vast volume of traffic to appear like normal traffic.

Using DNS tunneling to divert data to alternate servers is another method for exfiltration, offering attackers a command and control channel for their malware. Tunneling is a relatively fast way of extracting data, with one known attack delivering 18,000 credit card numbers a minute to an attacker’s server.

The invisible cloak of DNS traffic

Locating malware hidden in the crowd of DNS traffic can be like finding a needle in a haystack. Traffic analysis acts like a metal detector or magnet. It helps spot irregular requests and responses amongst heavy DNS traffic over time and analyses the amount, load and frequency of those requests – which can also indicate tunneling. Traffic analysis provides historical data that can confirm whether exfiltration happened or not.

Currently, 34% of organizations respond to attacks by closing down specific affected processes and connections and 29% shutdown a server or service. Inspecting DNS transaction data and searching for specific patterns in traffic in real time can spot malicious tunneling indicators. Attacks can then be blocked as soon as they are spotted without blocking legitimate traffic stops, meaning customers and staff will not experience any downtime.

Identifying unauthorized traffic is a key to determining if your business is potentially having data exfiltrated. Businesses should also utilize DNS filtration systems that can check links against a real time blacklist and automatically check if a DNS query is trustworthy or represents a risk of data theft.

Develop an incident response checklist

In the event malicious activity is found, the response must be quick. A plan is thus necessary to react. Three important components should be included in the plan:

1. Perform both general network monitoring and transaction inspection analysis of the DNS. Section off the DNS so internal hosts cannot resolve external domains.
2. Analyse both DNS payload and network traffic on a per client basis and make sure you can handle the resolution of external domains.
3. Make sure your business performs a security assessment to prevent future breaches. This includes having a separate set of recursive servers configured to resolve external records.

You need to be able to protect against intruders using DNS to both infiltrate your network and exfiltrate stolen data. That means choosing the right tools to stop DNS exfiltration. A modern DNS server that’s able to identify attacks quickly using real-time DNS Transaction Inspection provides the option of blocking data exfiltration as soon as it is spotted by the DNS server analysis tools.

Being a core foundation of the Internet, DNS is increasingly used to conduct attacks, particularly to extract valuable data, and yet, businesses continue to be unaware of their exposure. In light of GDPR, organizations have less than seven months to get ready. Non-compliance will completely destroy brand image and the massive financial penalties will hit companies hard. Having a robust and layered defense is essential. Businesses must evolve their level of security sophistication because without it, hackers win. Failure to prepare for DNS attacks means you can prepare to fail GDPR compliance.