{"id":2438,"date":"2017-10-12T22:48:36","date_gmt":"2017-10-12T22:48:36","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=2438"},"modified":"2020-05-06T10:27:56","modified_gmt":"2020-05-06T17:27:56","slug":"how-core-network-services-are-adapting-to-cloud-saas-world","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/how-core-network-services-are-adapting-to-cloud-saas-world\/","title":{"rendered":"How Core Network Services are Adapting to Cloud\/SaaS World"},"content":{"rendered":"

DNS is mandatory to access the Internet as it is the link between networks and applications. DNS is also the veins of your organization, so it\u2019s a popular place to focus on getting information out, as it’s open in a lot of organizations, and frankly, often ignored. Hackers have well understood this: now over 90% of malware uses DNS in the cyber kill chain.*<\/p>\n

On the other hand, it has been common for organizations in the banking and defense sectors to have isolated DNS to provide some \u201csecurity by obscurity\u201d. In other words, all potential DNS queries are answered by internal DNS servers because the organization has configured its own DNS to act like the whole Internet.<\/p>\n

It means that an internal query for\u00a0www.infoblox.com<\/a>\u00a0would get a Non-Existent domain (NXDOMAIN) reply and the same for APT or malware call homes like malwarec2c.info.<\/p>\n

Over the years, some organizations have had to create thousands of records in this root zone to deal with exceptions for some financial, news or security solutions. Maintenance of these exceptions can be very time consuming and is reactive.<\/p>\n

But, over the last two years, a clear trend has appeared: a rising number of these organizations have removed their internal root zone and opened DNS recursion to use Internet DNS for external queries.<\/p>\n

The reason for that? SaaS & Cloud initiatives.<\/strong><\/em><\/p>\n

A couple of examples clearly illustrate this:<\/p>\n

Office 365<\/strong><\/p>\n

Microsoft recommends not using a web proxy with Office 365**. The implication of this is that end hosts should be able to resolve DNS names associated with Office 365 resources using recursion querying Internet DNS.<\/p>\n

Amazon AWS<\/strong><\/p>\n

When using Amazon Elastic Load Balancing, a load balanced IP address changes approximately every day***. When you rely on internet DNS resolution it is unnoticeable, but if you have an internal root, some organizations had to change the IP for all the records associated with an Amazon ELB each day.<\/p>\n

So, removing this internal root zone opens the network to successfully communicating with SaaS & Cloud services, but the change needs to be carefully prepared:<\/p>\n

1)\u00a0Regarding the recursion flow<\/strong><\/em>. It is important to make sure that central internal DNS systems have the authority or conditional forwarding for all the internal zones. If not, these requests will flow to the Internet resulting in inaccurate replies and consequently impacting applications. This can also be a security issue since these requests reveal information about internal infrastructures and applications.<\/p>\n

2)\u00a0Regarding security<\/strong><\/em>. To address the risks of malware and APT DNS call home, DNS infiltration and tunneling, Fastflux & DGA that were the reason for implementing an internal root, it is critical to secure your DNS with reputation, signature and behavioral based security.<\/p>\n