{"id":2258,"date":"2015-11-03T19:49:48","date_gmt":"2015-11-03T19:49:48","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=2258"},"modified":"2020-05-06T10:30:08","modified_gmt":"2020-05-06T17:30:08","slug":"dns-firewall-is-not-a-next-generation-firewall","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/dns-firewall-is-not-a-next-generation-firewall\/","title":{"rendered":"DNS Firewall is not a Next Generation Firewall"},"content":{"rendered":"

\"\"<\/p>\n

In the 1990s, firewalls were all the rage– every organization big or small connecting to the Internet was jumping on the bandwagon to make sure it used a firewall at its corporate perimeter to keep malware and the bad guys out of the corporate network. That worked okay for some time, but soon the first-generation firewall was no match for attackers who started exploiting applications themselves (with vulnerabilities due to software misconfiguration or lack of security altogether) to launch malware and even steal data in some cases. A decade later, next generation firewalls or NGFWs began taking center stage, allowing administrators to apply policies to traffic based not just on port and protocol, but also applications and users accessing the network. Today, another a decade later, with hundreds of data breaches impacting a range of industries globally, including retail and financial institutions, and the fact that most malware isn\u2019t detected until 200+ days after the infection, we have learned the drawback of simply relying on a NGFW, without paying attention to and securing a critical protocol service that is typically allowed through it and that is easily exploitable: the Domain Name System or DNS.<\/p>\n