{"id":771,"date":"2018-05-02T21:48:06","date_gmt":"2018-05-02T21:48:06","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=771"},"modified":"2020-05-06T10:27:06","modified_gmt":"2020-05-06T17:27:06","slug":"activetrust-anywhere-protecting-networks-and-devices-on-and-off","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/activetrust-anywhere-protecting-networks-and-devices-on-and-off\/","title":{"rendered":"ActiveTrust Anywhere: Protecting Networks and Devices On and Off Premises"},"content":{"rendered":"

The ubiquity \u2013 and convenience \u2013 of mobile devices and the increasing incidence of cybercrime is causing security challenges for most companies that are experiencing diminishing control over where and when employees use their devices. In an ideal situation, a company could implement enterprise security policies and content categorization that always apply \u2013 independent of user actions. That\u2019s what we do at Infoblox. Our approach is to protect devices anywhere \u2013 on premises, roaming, or in remote or branch offices \u2013 without requiring any user authentication or action.<\/p>\n

Traditional Security Approaches Don\u2019t Work Anymore<\/h2>\n

So, what\u2019s going on that\u2019s allowing more malware to get through enterprise defenses? Cybercriminals are always evolving their methods to get around traditional security measures. For example, enterprise security architectures are typically standardized around web proxies and next-generation firewalls. Attackers have worked around these traditional defenses, using DNS to sneak in. In fact, over 91% of malware attacks use DNS (per\u00a0Cisco 2016 Annual Security Report<\/a>) in the kill chain.<\/p>\n

Although DNS was used initially as the control plane for Command and Control (C&C) servers, more and more hackers are using it as a data plane for payload acquisition or data exfiltration. They also are using DNS as a way to evade classical detection with methods like fast flux or DGA (domain generation algorithms).<\/p>\n

The implication is that infected end hosts may never issue a web request to the web proxy, which makes proxies useless in protecting the end host. In particular, these approaches have been very effective in\u00a0targeting point of sales systems<\/a>\u00a0(PoS) to load malware and exfiltrate data.<\/p>\n

Standard solutions are reactive and deliver protection very late in the chain. To deal with increasingly sophisticated malware, it is much more effective for enterprises to adopt a proactive approach and mitigate attacks at the very first step in the kill chain \u2013 DNS.<\/p>\n

DNS at the Center of the Storm<\/h2>\n

A lot of organizations mistakenly believe that they are protected \u201cby design\u201d with internal DNS roots (as I explain in a\u00a0previous blog<\/a>) with SaaS, DNS relying only on reputational protection or because the normal process for an end host is to use a web proxy.<\/p>\n

Unfortunately, this is not the case, as most major threats use DNS. Infoblox provides a useful tool,\u00a0Data Exfiltration Demo Portal<\/a>, to help you evaluate if your organization might be vulnerable to attack, including the following:<\/p>\n