Deployment of Domain Name System Security Extensions improves global security for .INFO
DUBLIN, IRELAND - 9 September 2010 - Afilias, a global provider of Internet infrastructure services, today announced that it has enabled Domain Name System Security Extensions (DNSSEC) for the .INFO top-level domain (TLD). .INFO was officially signed on September 1, 2010 and its Delegation Signer (DS) records were entered into the DNS Root by the Internet Assigned Numbers Authority (IANA) on September 4th, allowing the .INFO zone to be validated using DNSSEC. The signing of the .INFO domain enhances global security for the seventh largest TLD in the world, home to more than 6.5 million registrations.
"The deployment of DNSSEC for .INFO continues Afilias' long-standing commitment to ensure security in the domain name system," said Ram Mohan, Executive Vice President and Chief Technology Officer for Afilias. "Once fully deployed in .INFO, DNSSEC will provide a trusted foundation to authenticate DNS queries and responses and prevent DNS hijacking."
DNSSEC protects the DNS from cache poisoning exploits which can allow malicious entities to intercept an Internet users' request to access a website, and redirect or eavesdrop on the user without their knowledge, and with no ability to reassert control. DNSSEC introduces digital signatures to the DNS infrastructure and automatically ensures that users are not hijacked and taken to an unintended destination.
While Afilias completed the largest registry DNSSEC deployment on behalf of the Public Interest Registry when it enabled DNSSEC for .ORG in 2009-2010, the signing of the .INFO zone represents the first step in Afilias' recently announced "Project Safeguard" initiative, which will rollout DNSSEC across its registry and DNS platforms. Project Safeguard also includes an education and training program for Registrars to enable DNSSEC in their registration systems for website owners who intend to add DNSSEC signatures to their individual domains.
Now that the TLD is signed, Afilias will activate a "friends and family" period that will allow the public to gain experience with a select group of .INFO second level domain names that have also been signed. Shinkuro Inc. and Comcast have agreed to participate in this testing period. The list of "friends and family" domains includes: afilias.info, info.info, shinkuro.info, comcast.info, and 19 other domains from Comcast.
Later this year Afilias will be enabling DNSSEC for many of the other TLDs that it supports, in total adding DNSSEC for 13 more TLDs before the end of 2010. For more information on Comcast's participation, please see their DNSSEC Information Center: http://www.dnssec.comcast.net/
About .INFO
.INFO was the first generic, unrestricted TLD to be launched since .com and is the most successful new TLD launched in over 25 years. Registrations in .INFO first became available in 2001. Since then, .INFO has grown to become the fourth largest gTLD in the world with over 6 million domain names registered. .INFO Domains are currently available in ten Internationalized Domain Name (IDN) scripts. For more information on .INFO please visit http://www.info.info/ .
Afilias is a global provider of Internet infrastructure services that connect people to their data. Afilias' reliable, secure, scalable, and globally available technology supports a wide range of applications including Internet domain registry services, Managed DNS, and services in the RFID and supply chain market with its Afilias Discovery Services. For more information on Afilias please visit http://www.afilias.info/.
As the industry-wide paradigm shift to cloud computing and software-as-a-service gradually continues to make the transition from buzz to reality, security and availability continue to emerge as the main barriers to customer adoption. A recent ISACA survey of over 1,800 US IT professionals found that only 17 percent believe the benefits of cloud computing outweigh the risks. Only one in 10 respondents said they would consider using software-as-a-service (SaaS) for mission-critical applications.
While some of this hesitance can probably be attributed to an overabundance of caution and the general human tendency to be wary of change, some security concerns are well-founded.
Companies entrusting their sensitive data to a SaaS provider need to be reassured that the data cannot be accessed by unauthorized third parties, such as employees and other customers of the provider, whether at rest or in transit. Data leakage has always been a potential issue at the low end of the hosting market – budget customers on shared servers – but the co-tenancy sometimes involved in cloud computing carries the perceived risk of bringing the problem to enterprises. SaaS providers need to be open and transparent with their customers about their security precautions, such as their encryption and access control regimes, as well as their layers of physical security.
There are other concerns, such as distributed denial-of-service attacks. As DNS service providers and others can attest to, when you have many thousands, or millions, of customer accounts running on the same infrastructure, you increase the risk of that infrastructure becoming the target of an attack. It's the old all-your-eggs-in-one-basket problem. To a DDoS-attacker focused on extortion, political retribution or simple vandalism, a broad customer base looks more like a convenient, aggregated attack surface. They can channel their resources on a narrower choke point, getting their message across by attempting to cause maximum collateral damage.
Of course, the opposite case can also be made: securing systems can be an expensive proposition, and companies can actually benefit from the substantial economies of scale that SaaS providers offer in terms of cost and security. Benefits include the availability improvements brought about by consolidated patch management, the economics enabling a much more diverse technology base that is less vulnerable to exploits, and the ability to quickly respond to DDoS attacks by reallocating resources.
It's important that both SaaS providers and their customers do not overlook reliable DNS provision as a key component of their overall security strategy. Companies can often blow their budgets on a super-redundant hosting infrastructure and forget about DNS – the only way their customers can actually reach it. Far too many times DNS is allowed to become the weak link in the chain, making it an ideal target for would-be attackers. All DNS services must come with a Service Level Agreement (SLA). Accepting anything less than 100% up-time for that SLA means you are accepting downtime for your business.
SaaS customers, however, often forget about DNS. Signing up for Google Apps, for example, is fairly straightforward and free, so it's easy to be quickly lured into a false sense of security, believing that your critical applications now reside on one of the world's largest and most robust data centers. This is of course not completely true. While cloud services such as Google Apps have brought many efficiencies to enterprises, they usually do not natively support DNS resolution. If you've forgotten to effectively provision your DNS, and it goes down, so does your Google Apps.
For a SaaS provider, surveys showing customer reluctance to adopt your services should of course be of some concern. But this hesitance also provides cloud computing companies with excellent opportunities to differentiate their services. When customers make buying decisions with security and availability as their primary concern, there's a clear incentive for SaaS companies to compete on security – a rising tide that carries all boats with it.
Afilias plans to deploy Domain Name System Security Extensions in 13 more top-level domains
DUBLIN, IRELAND – 23 August 2010 – Afilias, a global provider of Internet infrastructure services, today announced that it will deploy Domain Name System Security Extensions (DNSSEC) across its registry platforms, signing 13 more top-level domains (TLDs) and increasing DNSSEC deployment among domain registries by 50 percent.
“Afilias has been a leader in DNSSEC deployment, including working closely with .ORG to plan, design and implement the .ORG DNSSEC strategy as early as 2007,” said Ram Mohan, Executive Vice President and Chief Technology Officer for Afilias. “We are pleased to introduce DNSSEC across our registry and DNS platform, protecting TLDs in our care from DNS cache poisoning and man-in-the-middle attacks, while maintaining consistency and convenience for registrars and their customers."
DNSSEC development began in the early1990s, but only recently became ready for broad deployment as an additional security measure to protect the DNS from cache poisoning exploits. Recently referred to as the Kaminsky bug, this exploit can allow malicious entities to intercept Internet users’ requests to access a website, and redirects or eavesdrops on these users without their knowledge, and with no ability to reassert control. DNSSEC introduces digital signatures to the DNS infrastructure and automatically ensures that users’ are not hijacked and taken to an unintended destination.
To deploy DNSSEC for these additional TLDs, Afilias is introducing a new global strategy, launched under its “Project Safeguard” initiative. Project Safeguard includes a registry and DNS infrastructure upgrade across Afilias’ global technology platforms to support DNSSEC. It also includes a year-long registrar training initiative to address technical issues concerning implementation of DNSSEC in registrar-registry transactions.
As part of Project Safeguard, Afilias conducted research across domain name registrars to understand the issues they face with DNSSEC deployment. Afilias’ Registrar DNSSEC Readiness Report found that:·
“Our goal is to help registrars navigate the challenges of enabling the next generation of Internet security with DNSSEC, by providing a simple and singular enablement process to easily deploy DNSSEC across Afilias-supported domain registries,” said Mohan. “The Project Safeguard initiative should ease the technical burden of DNSSEC deployment and could spur user adoption."
Afilias will deploy DNSSEC first in the .INFO domain in September, to be followed by TLDs that it supports in Asia, the Latin America/Caribbean, and Europe. Based on the proven strategy for the .ORG registry’s successful DNSSEC deployment effort, Afilias will adopt a similar, careful, step-by-step approach. This strategy will include a “friends and family period” which will coincide with registrar outreach.
Afilias is a global provider of Internet infrastructure services that connect people to their data. Afilias’ reliable, secure, scalable, and globally available technology supports a wide range of applications including Internet domain registry services, Managed DNS, and services in the RFID and supply chain market with its Afilias Discovery Services. For more information on Afilias please visit www.afilias.info.
###
DNSSEC statistics source: DNSSEC Deployment Initiative https://www.dnssec-deployment.org/wp-content/uploads/2010/06/TLD-deployment-Table1.pdf As of 13 August 2010 26 TLDs had deployed DNSSEC.
If the rise of phishing has taught us anything, it's that on the Internet, if a digital asset has value, there's somebody out there who wants to steal it. Whether it's a bank account password, a credit card number, a PayPal login, or even a magic sword in an online game, there's a fraudster somewhere trying to misappropriate it for his or her own nefarious purposes.
Domain names have always been a target for such criminals. Companies and individuals doing business online have few assets more valuable than their domain name. It may cost $10 or less to register one, but the domain name is the glue that connects a company to its customers; revenue and brand equity depend upon its security.
Domain theft is not a new phenomenon, of course. Sex.com, for example, was hijacked all the way back in 1995, when there was only one registrar. Its true registrant had to spend years in court to retrieve it. In more recent years, high-profile domains such as Panix.com, Baidu.com and even ICANN.org have been temporarily stolen by attackers using social engineering to exploit process vulnerabilities at domain name registrars.
It's surprising, given that domain name hijacking predates the creation of the competitive registrar market itself, that the industry has not done more in the last decade to mitigate the risks. ICANN's Security and Stability Advisory Committee (SSAC) noted as recently as last year that "pure play, secure registration service providers are rare, in part due to the fact that evaluating security measures does not play as prominent a role in customer decisions when choosing a registrar as it should."
However, registrant apathy regarding security may already be changing, according to a recent survey of savvy registrants.
There are three areas where registrars, in general, have room for improvement when it comes to security.
1. Better Authentication
The simple username/password authentication approach so common at Registrars has repeatedly been found vulnerable to social engineering attacks and should not be considered strong enough security for high-value domain name accounts. This is especially true when automated password reminders are available. If all an attacker needs to do is compromise a password or e-mail address in order to have complete control over a domain portfolio, registrants have the right to ask for stronger authentication.
Nowadays, it's common practice for large financial institutions to allow, or even require, multi-factor authentication before giving customers access to valuable assets. But it's not just banks. After the phishing black market put a dollar value on World of Warcraft accounts, the game's developer had to start offering players one-time password tokens, in the form of key fobs, as a second authentication factor, to decrease fraud.
When you think about it, the fact that magic swords are sometimes offered a greater degree of protection than domain names is pretty crazy.
2. Notifications
When someone logs into a registrar domain account they are given virtually the “keys to the kingdom” for that organization’s entire domain portfolio and DNS settings. If domain account access is compromised, then all it takes for the criminal is to login to the registrar account, change the registrant and other contacts associated with the domain, and then either change the DNS information to point to a new site or transfer the domains to a completely different registrar where it is difficult for to reclaim the names.
It is time registrants get routinely notified when such changes are made to their domain name portfolio, whether via e-mail, text or perhaps even telephone for the most critical items. The best scenario is to notify two or more authorized employees to provide for shift changes and/or redundancy. Social engineering is the attack of choice for hijacking domains, and it's harder to impersonate two people than one.
Because e-mail accounts are easier to compromise than phone numbers, using out-of-band communications channels, such as telephone or SMS text message, could also increase security.
3. Access Control
Usually, authenticated registrants have global privileges: they can change name servers, transfer out domains or cancel renewals, for example. The risk of domain hijacking could be further mitigated by employing more granular access controls once a customer has been "authenticated". Many registrants may wish to use a higher level of security on their primary domains, limiting critical privileges to certain high-status users. The learning curve here could be eased somewhat by the fact that existing registrar Whois records already usually describe at least three roles – the administrative, technical and billing contacts.
Registrars should enable Registrants to designate different contacts for different authority levels. This would accord Registrants the choice of better protection.
None of these measures need to be a drain on registrars' margins. Indeed, once in place, these will save money that is now spent resolving disputes after the fact by making criminal activity more difficult. Further, with domain name registrants increasingly looking at registrars' security provisions before they make their purchasing decisions, the opportunity presented by value-added premium services, designed for security and marketed to customers with high-value domain portfolios, should be obvious. Criminals look for the softest targets; with a little effort in just 3 areas, registrars can significantly improve the security they provide for registrants.
For more reading on this topic, see SSAC’s advisory to registrars on improving security: SAC040
(Disclosure: I am one of the charter members of SSAC)
Fourth annual .INFO Awards program will offer US$15,000 in prizes
DUBLIN, IRELAND – 10 August 2010 – Afilias, a global provider of Internet infrastructure services and registry for the .INFO top-level domain (TLD), today announced the opening of its fourth annual .INFO Awards program which recognizes the best .INFO websites around the world. From August 9th to September 10th any .INFO domain owner may submit their website to the .INFO Awards for a chance to win honors as the “Best .INFO website of 2010.”
“.INFO is an intuitive domain name choice for anyone looking to share their information with the world,” said Roland LaPlante, Chief Marketing Officer for Afilias. “.INFO has been the most successful new TLD ever launched, as evidenced by the millions of sites now operating worldwide. The .INFO Awards program not only gives us the opportunity to highlight the best .INFO sites from around the world, but also to allow Internet users to voice their support for their favorite ones.”
Afilias first launched the .INFO Awards program in Germany in 2007 and expanded the awards internationally in 2009. 2010 will mark the fourth year of honoring the best .INFO websites and highlighting the usefulness that the .INFO domain has added to the Internet in the nine years since its debut.
Qualifying submissions will be evaluated by a panel of online and media experts based on five key criteria including: presentation of content, functionality of the website, design, usability, and originality. The panel of judges will be announced on August 17th and will consist of experts in the fields of websites, design, and media.
A shortlist of the 10 finalists based on the judges’ scores will be published on October 5, 2010. Members of the public will then be able to vote for their favorite of the top 10 sites until November 2 at 11:59 pm ET. The public votes will be combined with the judges’ scores to select the top 3 winners, with first place being named the “Best .INFO website of 2010.” Winners will receive cash prizes allocated as: US$7,500 for first place, US$5,000 for second place, and US$3,000 for third place.
For details on entry requirements and restrictions please visit the Awards Rules. For more details on the .INFO Awards or to submit your site visit www.INFO-award.info.
About .INFO:
.INFO was the first generic, unrestricted TLD to be launched since .com and is the most successful new TLD launched in over 25 years. Registrations in .INFO first became available in 2001. Since then, .INFO has grown to become the fourth largest gTLD in the world with over 6 million domain names registered. .INFO Domains are currently available in ten Internationalized Domain Name (IDN) scripts. For more information on .INFO please visit www.info.info.
About Afilias:
Afilias is a global provider of Internet infrastructure services that connect people to their data. Afilias’ reliable, secure, scalable, and globally available technology supports a wide range of applications including Internet domain registry services, Managed DNS, and services in the RFID and supply chain market with its Afilias Discovery Services. For more information on Afilias please visit http://afilias.info.
###Afilias' Managed DNS team will be at ad:tech NY exhbiting their FlexDNS Platform. Stop by Booth #1938 to find out which flexible DNS solution is right for you!
Subscribe to our news
