{"id":8689,"date":"2023-05-08T05:55:13","date_gmt":"2023-05-08T12:55:13","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=8689"},"modified":"2023-08-23T10:32:19","modified_gmt":"2023-08-23T17:32:19","slug":"the-importance-of-dns-as-part-of-defense-in-depth-for-midsize-enterprises","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/the-importance-of-dns-as-part-of-defense-in-depth-for-midsize-enterprises\/","title":{"rendered":"The Importance of DNS as Part of Defense-in-Depth for Midsize Enterprises"},"content":{"rendered":"

It\u2019s no longer a question of if a cyber security attack will hit; but when. Companies need to do everything they can to keep a serious \u201cwhen\u201d from ever happening. In fact, in today\u2019s digitally dependent world, midsize enterprises across all industries receive hundreds of security alerts daily, of which only a small percentage can be investigated\u2014and only if security teams have the right security tools and staffing levels. The worst part? According to Gartner research, in 2021, only 5% of a midsize enterprise\u2019s IT spend was allocated to security\u20265%!<\/p>\n

Do you see the problem here? SecOps teams at midsize enterprises face an overwhelming amount of cyber threats to monitor with limited resources to address them. They are also hamstrung by siloed network and security tools that don\u2019t share full visibility and data. All of this is being managed by small SecOps teams which leads to burnout and job dissatisfaction. As if those concerns weren\u2019t enough, companies, when compromised, are getting hit with an average cost per data breach of $4 million.1<\/sup> We are talking about some serious repercussions here.<\/p>\n

How do midsize companies fall victim to cyber threats in the first place? Here\u2019s a look at how an attack cycle works from a kill chain perspective:<\/p>\n

\"\"<\/p>\n

Typically the attacker creates a malicious payload in what\u2019s called the \u201cweaponization stage,\u201d and delivers the payload to a target, often through a spear-phishing email. When a user clicks on the link, the device requests a connection to the Internet location, and the lookup is done via the DNS server. Then, network security devices, such as next-gen firewalls and web gateways, process the traffic and establish the connection. Once the connection is established, the payload is downloaded and executed on the target device. This is how the malware inserts itself into an environment. After creating a foothold, the attacker can now remotely control the device via command and control (C&C), move laterally, and finally carry out their intended goals such as data exfiltration.<\/p>\n

What\u2019s a resource-strapped midsized enterprise company to do? The answer is simple, ease the burden on perimeter defenses by utilizing a DNS-based security solution to \u201cshift left,\u201d and stop attacks at the beginning of the attack cycle, not after, when it is too late.<\/p>\n

\"\"<\/p>\n

The smartest way to disrupt the entire kill chain is to shut it down at the very outset\u2014at the point a device attempting to reach a malicious destination makes the initial lookup request to a DNS server. Using DNS as a first line of defense prevents resolution to a malicious domain at the beginning of the connection path\u2014before those requests even reach next-gen firewalls, web proxies, and gateways. In cybersecurity, this concept is known as \u201cshifting left,\u201d moving defense measures to the left in the connection path.<\/p>\n

Leveraging DNS for cybersecurity is critical when you consider that 92 percent of cyber attacks rely on DNS in their execution, according to the United States National Security Agency (NSA). And yet, according to IDC, only 42 percent of organizations are protected at the DNS layer.<\/p>\n

There\u2019s no doubt DNS is an essential network service. It is required for every device, including managed and unmanaged devices, and it spans the entire organization. As you can see in the above graphic, DNS-based security stops potential attacks sooner, taking the burden off security tools further down the line. As such, it is a vital component of defense-in-depth cybersecurity. Plus, DNS security can also include proactive machine learning (ML)-based threat hunting, which exposes DNS-based threats other security solutions would miss. This capability frees each security tool to do what it is designed to do in the most efficient way possible.<\/p>\n

But let\u2019s back it up a moment and discuss what a defense-in-depth strategy is and why it matters to midsized enterprises.<\/p>\n

Defense in Depth and DNS<\/h3>\n

If yours is a midsize enterprise, implementing defense in depth is crucial for protecting against cyber threats. As your business grows, so do the risks you face. Hackers and cybercriminals often target midsize enterprises for two reasons. First, because they have valuable data. And second, because these enterprises often lack the security protections larger organizations can deploy. As such, hackers view midsized enterprises as \u201ceasy\u201d targets.<\/p>\n

Defense in depth is a cybersecurity strategy that uses multiple layers of security to protect against cyber threats. The idea is to combine different security measures to make it more difficult for attackers to breach your network and steal your data. Traditionally, security layers often include firewalls, intrusion detection and prevention systems (IDS\/IPS), antivirus software, etc. I\u2019m advocating for the inclusion of an additional security layer to your security stack: DNS detection and response. This security layer does what other layers cannot\u2014it blocks a wide range of malware, ransomware, APTs, and other cyber threats from the start, at the initial DNS query. Moreover, it automatically bolsters protection for midsized organizations with limited staff, budget, and security expertise.<\/p>\n

Defenses that make use of DNS detection and response are readily deployable. If you have a network, you already have DNS in place. Since every device on your network relies on your DNS infrastructure, why not use DNS-layer security to deepen your defense in depth with every device interaction? Doing so imparts the following benefits:<\/p>\n