Analysis: DHS Domain Name System Breach Directive

On January 22, the Department of Homeland Security (DHS) issued a directive to government agencies in response to breaches of the Domain Name System (DNS). The attackers used stolen credentials to alter DNS entries and steal certificates used for encryption and decryption. In combination, these actions let the attackers redirect sensitive traffic to their own sites, and to decrypt the traffic once it was received.
DHS’s directive provides good advice for responding: audit DNS records & prioritize those related to critical services; change DNS account passwords; add multi-factor authentication to DNS accounts; and monitor and review certificate logs. The time frame for these actions is ten days, but MFA implementation can be postponed indefinitely with an explanation of why it cannot be implemented. DHS also warns, rightly, against the use of SMS-based MFA (i.e., the kind where a security code is texted to the user).
Several questions arise. Do agencies have the tools and expertise to conduct these response activities? Do they have the infrastructure and software to implement MFA quickly? Why don’t these agencies have MFA on DNS accounts in the first place? Did affected agencies have strong controls in place on systems storing sensitive data while leaving DNS servers relatively unprotected? Can agencies correlate findings to validate the identification of perpetrators?
After these initial tasks, affected agencies will need to determine what data was compromised and when, assess the impact of the breach, conduct forensic investigations to identify the attacker(s), and share that threat intelligence without creating a secondary risk. If Personally Identifiable Information (PII) was taken, victim notification will be necessary, and if covert operations of any kind were compromised, then safeguarding those human assets will be a top priority. Depending on the data stolen, other adjustments to operations will likely be necessary.
Under the NIST Risk Management Framework (RMF), Federal IT systems are assigned an impact level of “High”, “Moderate”, or “Low”. The impact level determines the stringency of security measures implemented on those systems. Do all agencies assign the same impact level (and attendant security controls) to DNS systems? Is a review of impact levels appropriate, to ensure the appropriate safeguards are in place?
This incident reveals:
• The need for adequate identity protection, particular privileged accounts that should be protected by MFA
• The need threat hunting and post-incident investigative tools and expertise
• The need for an inconsistent assignment of impact levels to mission-critical systems such as DNS servers, or systems hosting DNS”
DHS’ incident response capability has improved significantly in recent years, and for that, they deserve great praise. The next phase is to concentrate on a harder task: incident prevention.
Related Blog Posts
Cybersecurity January 6, 2021
Cybersecurity attacks have been a part of the national security conversation since the beginning of the technological age. However, with a significant changes in 2020, we have seen more intrusions in the first half of 2020 than throughout all of 2019 (as reported by NETSCOUT). A new wave of highly sophisticated attacks has evolved with fear tactics and the change of work environments from offices to work from home.
James Jaramillo
Cybersecurity November 30, 2020
Election day has come, and it has gone, with a few states still counting votes, the projected President-elect is Joseph R. Biden, with Vice President-elect Kamala Harris making history as the first African and Asian American women to be elected to higher office. However, just because the election is over does not mean that the task of securing the U.S. elections infrastructure stops; in fact, the work must continue.
James Jaramillo
Cybersecurity November 3, 2020
With election day upon us, and with millions already mailing in their ballot or taking advantage of early voting, it is safe to say this election will be like no other. However, this record-breaking turnout does not slow down bad actors from Iran and Russia from interfering in the upcoming election. According to a recent announcement from the FBI, both Iran and Russia have obtained US voter information.
James Jaramillo
Cybersecurity October 29, 2020
If your business sells products or provides services to the Department of Defense (DoD), then you should know about the Cybersecurity Maturity Model Certification (CMMC) program.
Don Maclean
Cybersecurity, Federal Government October 29, 2020
With just days remaining until Election Day, election security and mail-in voting have played a significant role in this presidential race. Currently, eighteen states and D.C. have started to ease and expand access to vote by mail due to the pandemic. This expansion allows concerned voters to avoid being exposed to the virus at polling places and still allows citizens to exercise their democratic rights. However, the question on every election official's mind across the country is how the United States post office will handle the expected influx in mail-in ballots?
James Jaramillo
Cybersecurity September 29, 2020
“The best virtual experience in cybersecurity” is fast approaching. On October 14-15, the Institute for Critical Infrastructure (ICIT) – the only think tank dedicated exclusively to cybersecurity – hosts its 2020 fall virtual briefing. Co-chaired by DLT, this year’s theme is: “A Secure Roadmap for the Future.”
Brandon Norris
Cybersecurity September 28, 2020
DLT Solutions recently sat down for an interview with Joyce Hunter, executive director for strategy and process at the Institute for Critical Infrastructure and Technology (ICIT), the nation’s leading cybersecurity think tank. On the table for discussion was how ICIT is cultivating a “cybersecurity renaissance” – including promoting the role of women in cybersecurity. We also talked to Hunter about how government agencies can compete more effectively for cybersecurity talent and nurture the next generation of cyber warriors.
Don Maclean
Cybersecurity August 19, 2020
There are 76 days until the 2020 presidential election, and it has already been upended by an unfortunate pandemic that has required states to go back to the drawing board to re-evaluate how voting will take place on November 3rd. However, government officials, particularly at the local level, not only have to contend with a pandemic but also an increase in digital threats such as ransomware attacks. These attacks are being used to create chaos in political campaigns and steal voting data before election day.
James Jaramillo
Cybersecurity July 28, 2020
Article by James Hofsiss, CISSP, DLT and Asad Zaman, Sales Engineer III, DLT
DLT Solutions
Application Lifecycle, Cybersecurity July 17, 2020
Federal agencies are developing and releasing software and apps at a rapid speed. This haste comes at a price. Verizon reports that nearly 70% of the data breaches it investigated in 2019 were due to attackers targeting vulnerabilities in public-facing web applications. It also introduces compliance risk.
Farah Alam
Cybersecurity July 13, 2020
With the general election approximately 113 days away, there are mounting concerns about what will occur on Nov 3rd, 2020! Election officials face an extensive array of new cybersecurity threats arising from voting remotely to election officials working from home on unsecured systems leaving delicate data exposed to hackers. Before this health crisis, Congress approved $380 million in grant funds through the Help America Vote Act (HAVA).
James Jaramillo
Cybersecurity May 12, 2020
The old saying goes, there are only two kinds of organizations: those that have been breached and those that will be soon. Clearly, the “moat-and-castle” approach to security has not worked. Simply being “inside” a network – behind a firewall, DMZ and other traditional defenses – does not confer trustworthiness, whether it’s a device, a user, network traffic, or an application.
Don Maclean
Cybersecurity, IT Infrastructure April 22, 2020
Election security is a big topic, but it resembles a many-legged centipede. Federal contractors face the reality that elections are the purview of state, county and municipal officials. The technical and managerial abilities of these entities vary from what you might expect in a tiny hamlet to what you might encounter in a million-person suburban county.
David Blankenhorn
Cybersecurity April 14, 2020
DHS recently published version 3.0 of the Trusted Internet Connection (TIC) architecture. A response to changing IT conditions, Executive Orders, and OMB mandates, the new architecture seeks to support IT modernization through cloud adoption while keeping security as a top priority. The comprehensive set of documents includes an overview, a catalog of security capabilities, a reference architecture, guidance for pilot programs, advice for service providers, and a very helpful set of use cases relevant to agency needs.
Don Maclean
Cybersecurity April 14, 2020
The Threat
Risk is a function of likelihood times impact. When it comes to zero-day exploits, particularly those that use return-oriented programming (ROP) or one of its many cousins the likelihood is high, and the impact is higher. How do these attacks work, and what is the industry doing to stop them? More importantly, what can you do to stop them? Is it possible to stop a zero-day without patching or updating systems? Let’s explore these questions.
How ROP Works
Don Maclean
Cybersecurity March 20, 2020
The Cyberspace Solarium Commission recently released a groundbreaking report detailing 75 recommendations for improving the cybersecurity of the nation, including both the private and public sectors. The Commission, bipartisan in both name and spirit, conducted over 300 meetings with industry, academia, U.S. government, think tanks and foreign governments. I had the privilege of participating in this effort. The result is a comprehensive report that urges immediate and concrete action on its recommendations, organized into six pillars”:
Don Maclean
Cybersecurity March 20, 2020
Last week, my associate, Shane Rogers, shared an article on GovCybersecurityHub discussing the Cybersecurity Maturity Model Certification (CMMC) and its potential impact on small- and medium-sized government contractors.
Don Maclean
Cybersecurity March 20, 2020
I recently had the opportunity to visit an amazing new facility—the Cyber Range at Tech Data—and got to meet the truly exceptional people who make it happen. The facility has many purposes, stemming from the powerful sense of mission that drives the staff.
Don Maclean
Cybersecurity March 19, 2020
At RSA this year, Chris Krebs gave an important talk: “Cybersecurity Has a Posse” where he stressed the importance of collaboration between government and industry to fight the cybersecurity war. He started by pointing out that his agency, Cybersecurity and Infrastructure Security Agency (CISA) is an “all-source” group. He meant that CISA collects threat information from sources all over the world, including government agencies, private industry, and more. Krebs’ group consolidates that information and disseminates it – daily – to security professionals across all industries.
Don Maclean
Cybersecurity March 18, 2020
With the designation of the COVID-19 disease as a global pandemic hotly followed by a declaration of a national emergency by President Trump, the American way of life shifted dramatically – with the home office becoming a new reality for millions.
Unfortunately, the rise in the global remote workforce puts more pressure on IT teams, network architectures, and even equipment. But there are also very real cybersecurity challenges to consider.
DLT Solutions
Cybersecurity December 2, 2019
By Brandon Shopp, VP, Product Strategy, SolarWinds
Is unnecessary complexity making Office 365 monitoring a headache for your agency? A new presidential mandate requires federal agencies to “transform and modernize” their IT systems, with the goal of creating a more streamlined, cost-efficient, and secure IT environment.
DLT Solutions
Cybersecurity October 23, 2019
This is a repost of a blog originally posted to GovLoop here.
This blog post is an excerpt from our new report, How Artificial Intelligence Combats Fraud and Cyberattack, download the full report here.
DLT Solutions
Cybersecurity October 23, 2019
The security of public sector networks is under attack. Each day security and IT professionals work hard to defend the integrity of mission-critical data and systems against increasingly frequent and complex cyberattacks.
Staying informed is critical to staying ahead.
That’s great, but there are literally dozens of cyber news outlets, journals, and bloggers to follow. Security leaders and practitioners don’t have time to filter what’s urgent and relevant to their organizations. That’s why we’ve created GovCybersecurityHub.
Don Maclean
Cybersecurity October 17, 2019
*Article written by Jim Hansen, VP of Products, Security and Application Management
DLT Solutions
Cybersecurity October 10, 2019
This month, DLT sat down with James Ebeler, the Chief Technology Officer, Department of Defense, for Iron Bow Technologies. In this interview, James discusses the cybersecurity challenges facing our military and how Iron Bow is helping solve them with innovative solutions.
DLT: Good morning, James. Thanks for joining us today for this interview.
James: Good morning, happy to be here.
DLT: Fantastic, let’s dive right in. First, can you tell us about your role at Iron Bow Technologies?
DLT Solutions
Cybersecurity October 10, 2019
The first half of 2019 continued to be a busy one for cybersecurity teams and their organizations. But the nature of the adversary is changing.
New insight from DLT partner, CrowdStrike, finds that attackers are “continuing to ramp up in both their brazen behavior and sophisticated means.”
Don Maclean
Cybersecurity October 10, 2019
*Article originally posted on GovCybersecurityHub here.
DLT Solutions
Cybersecurity September 24, 2019
The DoD Cybersecurity Strategy https://www.fifthdomain.com/dod/2018/09/19/department-of-defense-unveils-new-cyber-strategy/ stresses nine key points. With the end of FFYE looming, are you aligning your spending with these objectives?
Don Maclean
Cybersecurity, IT Perspective August 2, 2019
Every Federal IT pro knows that security threats are a top agency priority. Yet, according to the SolarWinds 2019 Cybersecurity Survey, those threats are increasing—particularly the threat of accidental data exposure from people inside the agency.
DLT Solutions
Cybersecurity July 31, 2019
Capital One has announced that about 140,000 Social Security numbers and 80,000 linked bank accounts were compromised “in one of the biggest-ever data breaches,” affecting some 100 million individuals in the U.S. and 6 million in Canada.
DLT Solutions
Cybersecurity, Healthcare July 29, 2019
More and more organizations are making the move to cloud-based security solutions. Today, 33 percent of organizations are planning to adopt one or more security-as-a-service (SECaaS) solutions. The efficiency with which endpoint security solutions can provide protection, particularly when delivered as-a-service, is a key strategic consideration for many organizations – perhaps none more so than America’s network of medical schools and teaching hospitals.
DLT Solutions
Cloud Computing, Cybersecurity July 22, 2019
It’s often said that there are two types of organizations: those that have been hacked, and those that will be – turning the conversations around security breaches from ‘what if?’ to ‘when?’.
Isabella Jacobovitz
Cybersecurity July 10, 2019
Although state and local technology leaders are increasingly prioritizing cybersecurity in their operations, government has a long way to go in securing critical information and systems from cyberattacks.
In light of this struggle, Route Fifty, in partnership with CrowdStrike, recently hosted a webcast that showcases the work of state and local governments who have undergone a transformation in cybersecurity protocols – and the challenges they continue to face.
Melissa Perez
Cybersecurity March 29, 2019
Many government agencies, particularly large agencies, face enormous obstacles in simply compiling and inventory of the software and hardware under in their system. The difficulty is understandable: I know of one agency responsible for 220,000 makes and models of medical devices (note that this number refers to “makes and models” only. The actual number of devices is much, much higher). In addition, the devices are online intermittently, and many of them are on air-gapped (i.e., physically separate networks), complicating the use of automated tools for identification and inventory.
Don Maclean
Cybersecurity March 28, 2019
Every government organization has been the victim of a cybersecurity incident. These can range from mundane incidents such as a user leaving their desk without locking their screen, up to a major breach such as the OPM hack in which hackers stole comprehensive and confidential information on millions of government employees and contractors.
Don Maclean
Cybersecurity March 27, 2019
Identity and Access Management (IAM) is the art and science of ensuring that someone is who they say claim to be. This ensures that they have the correct level of access to systems and data – enough to do their job, but no more. IAM systems cover a wide range of features, but typically include:
Don Maclean
Cybersecurity March 26, 2019
Cybersecurity assessment initiatives and frameworks abound in the US government, the most important being the Federal Information Systems Management Act (FISMA), passed in 2002. The law’s broad scope included a mandate to the US National Institute of Standards and Technology (NIST), charging it to create methods and standards to assess and optimize the cybersecurity posture of US government agencies.
Don Maclean
Cybersecurity March 25, 2019
“Hope for the best, plan for the worst”. This ancient principle still applies, especially for systems with high availability requirements. Principles are easy to quote, but how does an organization implement them effectively?
Don Maclean
Cybersecurity March 22, 2019
Cybersecurity endures as a top priority for federal agencies, the Trump administration, and Congress. So whatever other budget battles that might lie ahead, cyber will remain an important opportunity. In fact, two recent reports ought to scare the heck out of not just agency managers but pretty much every American.
Brian Strosser
Cybersecurity March 22, 2019
The “Internet of Things”, or IOT: we’ve all heard the term, but what does it really mean? More importantly, how do we secure all of these … “things”?
Don Maclean
Cybersecurity March 21, 2019
Cell phones, tablets, wearables, and other mobile devices dominate our lives. I personally bring my trusty iPad to everywhere, and, like everyone else, have my phone with me at all times. The biggest attack surface for any enterprise, then, may well be these devices. How can we assess the threats? What are the components in need of protection? What are some key methods of protecting them?
Don Maclean
Cybersecurity March 20, 2019
Earlier this month, I wrote about the Zero Trust model for security. As I proceed through these daily blogs, I find many of them complement the ZT model; data security is one. Outside the IOT world, the goal of cybersecurity is to protect data. The Zero Trust model recognizes this and focuses on keeping security close to the asset, and portable.
Don Maclean
Cybersecurity March 19, 2019
Configuration management is a many-headed beast, but the biggest beast with the sharpest teeth is the patch monster. Every day, a new vulnerability, a new patch – and an old decision: patch and maybe break something (I’m looking at you, Spectre and Meltdown), or stay online and be vulnerable. This model – “panic patching” -- is in wide practice, but not sustainable. For now, an efficient and reliable system is essential; for the long term, we need an entirely new model.
Don Maclean
Cybersecurity March 18, 2019
By now, you’ve heard it a hundred times: the perimeter is breaking down, no more “crunchy outside” to protect a “chewy inside”, no more castle-and-moat model of network infrastructure security. If there is no inside and outside, then where do defenses belong? What security architectures make sense for such amorphous network?
Don Maclean
Cybersecurity March 15, 2019
Once upon a time, endpoint security was just a hall monitor: it watched for known bad files identified with a simple signature and sent you an alert when the file was blocked. To be safe, it would scan every machine daily, an intrusive activity that slowed down machines, and sped up the heart rates of affected users and hapless analysts at help desks.
Don Maclean
Cybersecurity March 14, 2019
Insider Threat: it’s one of the biggest and most persistent issues in cybersecurity. High-profile cases – Manning, Snowden, and others – have kept the issue in the public eye; government security personnel are rightfully concerned. In addition to the willfully malicious, though, many insiders lack ill intent, but pose a threat just the same.
Don Maclean
Cybersecurity March 13, 2019
Do developers at your company keep application security top of mind when coding? Do they have training in secure code development? Do they have the tools to develop code securely? If they find a security issue, can they quickly fix the issue in all instances throughout a large-scale application? If they use open-source code, do they verify its security?
Don Maclean
Cybersecurity March 12, 2019
“Build it in, don’t bolt it on” is a mantra we all learn when we study cybersecurity, yet we see it in practice far too rarely. Our adversaries also know this principle and have begun to implement it by infecting the supply chain – hardware and software – as close to the source as possible. DLT technology partners Crowdstrike and Symantec both note the trend in recent threat reports. In their July,2018 report1, Crowdstrike notes that:
Don Maclean
Cybersecurity March 8, 2019
Phishing, vishing, whaling, spear-phishing: the list of clever new terms seems constantly to change. A successful attack by any other name, though, is just as sweet to the adversary. Terminology aside, the fundamental problem is this. Phishing is the most common and effective way to steal data because it goes after the weakest chain in our cybersecurity armor: the human being. Even high-profile people, including one CEO of a major cybersecurity firm and major figures in law enforcement, have fallen victim to phishing attacks.
Don Maclean