{"id":720,"date":"2018-04-23T20:08:01","date_gmt":"2018-04-23T20:08:01","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=720"},"modified":"2020-05-06T10:27:07","modified_gmt":"2020-05-06T17:27:07","slug":"saas-dns-security-are-you-protected","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/company\/saas-dns-security-are-you-protected\/","title":{"rendered":"SaaS DNS security: Are you protected?"},"content":{"rendered":"

Are SaaS security solutions truly the panacea they are publicized to be? The answer is, it depends on how the SaaS solution is architected. A majority of SaaS-only security solutions are \u201coverlay\u201d solutions that simply provide an additional layer of security on top of an enterprise\u2019s existing network and security infrastructure. These overlay solutions are easy for the vendor to develop, but difficult for the customer to combine with other existing security solutions and derive value from. In contrast, a hybrid approach to security is one that tightly integrates SaaS solutions with an enterprise\u2019s existing IT infrastructure and leverages SaaS capabilities to seamlessly extend and scale on-premise solution performance. With a hybrid solution, the vendor does the heavy lifting of seamless integration with existing infrastructure, thus providing a unified solution, which unlocks valuable context available from the on-premises infrastructure. Such context allows the hybrid solution to prioritize threats better. In addition, the unified solution enables sharing of data with broader security ecosystem for an efficient and optimized incident response.<\/p>\n

DNS as a Security Tool<\/h1>\n

As enterprises gear up to handle the barrage of increasingly targeted and sophisticated cyber attacks, security architects must take advantage of the visibility that each IT asset can provide. DNS is an excellent example of a scalable and pervasive network infrastructure protocol that offers unmatched visibility into network traffic patterns, malicious and otherwise. If used optimally, DNS can provide an affordable and scalable first line of defense for detection and mitigation of the vast majority of known threats. Behavioral analysis of DNS traffic can also serve as an \u201cearly warning system,\u201d flagging potential zero-day threats in the network.<\/p>\n

When it comes to DNS security, many organizations are interested in cloud-based SaaS-only solutions, which they think will be easier to implement and provide sufficient functionality to identify infected devices and protect against threats like malware and phishing attacks. SaaS for DNS security can be effective, but only when integrated with on-premise systems.<\/p>\n

Overlay (SaaS-only) solution challenges<\/h1>\n

The way most SaaS-only DNS security solutions work is to enable businesses to forward their DNS traffic to the cloud, where DNS queries are processed and potential malicious activity is detected and flagged. In order to identify the infected end host, these solutions require the deployment of DNS forwarding proxies (running on virtual machines) deep inside the enterprise network or the use of endpoint agents. As enterprises move their workloads into private and public clouds, deploying and managing these proxies can become even more complicated.<\/p>\n

Most enterprise DNS servers support the ability to block access to domains via configuration of response policy zones. By directing all DNS traffic to the cloud, SaaS-only solutions fail to leverage these existing security capabilities, which allow an enterprise to block the most egregious threats at the very first DNS server that detects it.<\/p>\n

Further, because overlay solutions do not integrate with the incumbent enterprise DNS architecture, they leave enterprise administrators stuck with operating two separate and siloed management systems and having to manually correlate data between the two. Beyond the inefficiencies of managing two separate DNS systems, an even more significant drawback is that you sacrifice visibility and security context. Specifically, overlay solutions are unable to leverage the rich contextual data available in the enterprise DNS, DHCP, and IP address management systems (DDI). This context can help with prioritization of security threats, a key requirement for security analysts who are swamped with alerts they can\u2019t keep up with.<\/p>\n

Why a hybrid approach for DNS security<\/h1>\n

To recap, a hybrid DNS security approach weaves security right into the network control fabric of the enterprise. Tight integration with the incumbent enterprise DNS, DHCP, and IPAM infrastructure simplifies deployment and management brings efficiency and scale and improves overall security efficacy and effectiveness.<\/p>\n

Hybrid solutions offer enterprises complete flexibility in terms of deployment options \u2013 the best combination of on-premise and SaaS. And regardless of the deployment model, enterprises get all the benefits of integration with their DDI infrastructure:<\/p>\n