In this lesson, we're going to talk about
securing the domain name system.
The domain name system is a critical component
in our networks because it's allowed to redirect
network devices from one domain name
to its associate IP address.
If an attacker can gain control of your DNS server
and change its contents,
it can then reroute a normal request to a Compromise Server
to collect additional information about your users.
For example, if I was able to change
the IP address of facebook.com
and your internet service provider's DNS server,
I can redirect every one of their clients
to a Compromise Server that I control
that may look and feel just like Facebook
and whenever their users attempt to log in,
I can actually copy their usernames and passwords down
and then redirect them to the real Facebook page
while I keep a copy of their login credential data
for myself to use later on as an identity thief
or some other type of attack against them
and their Facebook friends.
Unfortunately, when DNS was first created,
security wasn't really a big consideration for us,
and this means that DNS is susceptible to various forms
of manipulation and attack.
To secure this critical portion
of our network infrastructure,
several security measures have been developed
over the years, including DNS security extensions,
DNS over HTTPS, and DNS over TLS.
First, we have the DNS security extensions.
The DNS security extensions usually referred to
by its acronym of DNSSEC,
provides a digital tamper-proof seal for your DNS data
to ensure that the information reaching your device
is exactly what that server intended to send you.
This is achieved through a sophisticated system
of cryptographic signatures,
they're attached to your DNS data.
These signatures are verified against the chain of trust,
all the way up to a globally recognized anchor.
With DNSSEC, even if an attacker redirects your traffic
using a falsified DNS record, the lack of a valid
cryptographic signature will make it easy to spot
and prevent a successful exploitation from occurring.
Without that trusted seal, the system knows
it shouldn't trust this misleading direction
and will treat it as suspicious or malicious in nature.
However, DNSSEC with all its robustness
doesn't actually encrypt any of your DNS data.
So if anyone is listening on the network, they can still see
where you're heading to on the internet,
even if they can't tamper with the contents
of that DNS packet.
Second, we have DNS over HTTPS.
Now, DNS over HTTPS or DoH as it's abbreviated,
is used to send our DNS queries
through the HTTPS protocol, which is the same protocol
that secures your data when you're entering
sensitive information on a website.
This not only encrypts the contents of your DNS queries,
but it also blends it seamlessly with the rest
of your HTTPS traffic to make it more difficult
for eavesdroppers to single out
and keep track of your DNS requests.
Third, we have DNS over TLS.
DNS over TLS, or DoT as it's abbreviated
takes a different approach to securing your DNS queries
while they're in transit.
Instead of saying our DNS traffic
over an encrypted HTTPS connection,
we instead going to encapsulate our DNS traffic
inside of a transport layer security tunnel.
Like DNS over HTTPS, DNS over TLS will provide privacy
for your DNS data
because it's encrypted, so the attacker cannot eavesdrop
on the conversation and determine what DNS records
you've been querying.
Now, both DNS over HTTPS
and DNS over transport layer security tunnels
address a critical issue in internet privacy by preventing
what is known as DNS snooping, where the prying eyes
of an attacker will monitor DNS queries
to infer what websites a user is visiting.
By encrypting these queries, DNS over HTTPS
and DNS over TLS can ensure that your online activities
are shielded from unwanted scrutiny.
Securing DNS is not just about privacy, though,
it's also about integrity and trust.
By implementing DNSSEC, DoH,
and DoT, we're not just securing a technical process,
but we're actually safeguarding trust
in the digital ecosystem
to ensure that the invisible pathways that our data
is going to lead us to are going to take us
to the right destinations that are unspoiled and unscathed.
In practice, adopting these technologies does involve
a collaborative effort by various stakeholders.
Website owners have to embrace DNSSEC
to protect their domain names and internet service providers
and organizations also need to consider supporting DoH
and DoT by offering their users a secure pathway
for their DNS queries.
However, it's essential to navigate this road
with an understanding of its nuances.
For instance, while DoH offers exceptional privacy
by blending DNS queries with regular web traffic,
it also shifts the control of the DNS resolution
from your local network,
perhaps managed by your organization or ISP
over to a third party DNS over HTTPS provider.
This shift calls for a thoughtful balancing act
between privacy, control
and trust that requires each entity
to carefully choose their partners in achieving this level
of digital security.
So remember, when it comes to securing DNS,
you need to remember that we aren't just trying to protect
our data, but we also need to preserve some trust
and reliability for our networks and the internet at large.
By understanding and implementing DNSSEC, DoH,
and DoT, we're not just fortifying our digital defenses,
we're actually nurturing a secure, trustworthy environment
for the free flow of information, ideas, and innovation.