Page 5 - December_Newsletter_2023

Safe Now? Well not really. Alan then took a look at how the data is transmitted to try and understand what hap-
pens when you send your data out into the ether.

We now come across the DNS. The Domain Name System (DNS) is the phonebook of the Internet. Humans ac-
cess information online through domain names, like nytimes.com or espn.com. Web browsers interact through
Internet Protocol (IP) addresses. The DNS turns domain names into IP addresses, which browsers use to load in-
ternet pages. Every device connected to the internet has its own IP address, which is used by other devices to lo-
cate the device.

What is the risk of using a DNS?

DNS data that is provided by name servers lacks support for data origin authentication and data integrity. This
makes DNS vulnerable to man in the middle (MITM) attacks, as well as a range of other attacks. These limita-
tions, combined with advances in technology, make DNS servers vulnerable to a broad spectrum of attacks, in-
cluding spoofing, amplification, DoS (Denial of Service), or the interception of private personal information.

Alan then went through a number of security options, their advantages and disadvantages.

DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography. With
DNSSEC, it's not DNS queries and responses themselves that are cryptographically signed, but rather DNS data
itself is signed by the owner of the data. Every DNS zone has a public/private key pair.

While DNSSEC offers many benefits, such as improved security and trustworthiness of DNS data, it also has
some drawbacks, such as increased complexity and management overhead.

DNS over TLS (DoT): A protocol for encrypting DNS requests to make them private and secure is called DNS
over TLS, or DoT. The same security protocol, TLS, used by HTTPS websites is also used by the DoT for com-
munication encryption and authentication.

A disadvantage of DNS over TLS is server compatibility. Not all DNS servers support DoT, which can make it
difficult to use this protocol in certain environments. Moreover, some DoT servers may not support certain fea-
tures, such as DNSSEC, which can limit the security benefits of the protocol.