The ART of Security Summit: Strategic Risk Management for CISOs

Clips
More from The ART of Security Summit: Strategic Risk Management for CISOs

Joseph Hall

Stealth Infoblox Threat Intel

Infoblox

play_circle_outline Importance of DNS in reducing risk in modern internet security

play_circle_outline DNS resolution process and its impact on company connectivity

play_circle_outline Predicting and preventing zero-day attacks with DNS data analysis

play_circle_outline Managing DNS for security, privacy, and resource efficiency

Info

Joseph Hall, Stealth Infoblox

Joseph Hall

Stealth Infoblox Threat Intel Infoblox

Jackie McGuire

>> Welcome back to the Art of Security Summit. I'm Jackie McGuire, practice leading Principal Analyst for Security at theCUBE and SiliconANGLE Media. I am very excited to be joined by one of my best friends and one of the smartest people I know, Joe Hall. Joe, I think you said your title is Principal Threat Researcher at Infoblox. Is that correct?

Joseph Hall

>> Yes. Yes. That's what we're telling everyone right now.

Jackie McGuire

>> All right. Well, Joe's here to talk to me today about reducing risk. And so, we've already talked about some of the ways that you can avoid risk both with strong training and identity programs, but at some point, something's going to get in. So I thought we talk about reducing risk, and Joe, you work with one of the often overlooked but most critical pieces of technology in the modern internet, which is DNS. And DNS is actually one of the ways that we see a lot of threats manifest, but also, one of the ways that we can really reduce risk. So, I don't think that I am smart enough about what you do to explain it intelligently. So I'm going to have you explain what Infoblox does, what you do with DNS and why that's so important in the internet.

Joseph Hall

>> Yeah, definitely. So we are one of the biggest providers of security in DNS. I came from a background of firewalls and a lot of encryption with PGP, various other security protocols and ways to prevent bad guys from getting into a network. So, DNS is frequently overlooked because the data set is massive and it's noisy and there's a lot to go through, but the data's rich and what happens in DNS can make or break your company's connectivity and your ability to do business. It can also generate a lot of noise and cost if you're not managing it correctly and well. One of the frequent ways that companies will configure themselves, especially smaller businesses, they don't think about DNS. They'll think about their firewall and their EDR and they don't think DNS is a big deal. Sometimes they'll even set it to a public resolver like 8.8.8 and call it good.

Jackie McGuire

>> So I guess just to take a step back at the absolute most basic level, my understanding, like I'm a fifth grader is that DNS is the thing that when I type in Google.com resolves the text that I put in my address bar to an actual IP address on the internet, correct?

Joseph Hall

>> Correct. And that will take you to that server wherever it is, and it'll route over those IP addresses to get across the network to achieve that. DNS will resolve an SLD. So you'll have the URL like you just said, Google, and it will resolve to an IP address. That IP address is someone else's computer. That's a server somewhere, that's a container in an AWS cluster, somewhere you don't know. The point is during that resolution, you want to know where it's going to. So firewalls will do something where they'll identify various different threats and they will identify URLs and things like that too, but they'll identify all these different threats and they try and unify all that into a security stack that's unifying, gives you all the bells and whistles, but it doesn't focus heavily just on DNS and more importantly, it doesn't focus on both directions. So they'll look at just the queries from the client machines going out. They won't look at any of the comms coming back from the servers publicly, which there can be malicious code inside of that. There's injections that happen where they can push code through the responses from the server. So DNS is overlooked because people will just think it's an operational thing and there's a lot of inherent trust that happens there. Just like switching infrastructure, a lot of it's trusted and you just expect it to work. The problem with that is, if you're going out to a public site, you are radiating all of that public information. So, if you have private resolutions happening on your network for a computer name or a server name or something like that and your DNS is set to an external source, you're handing off all of that telemetry to that source.

Jackie McGuire

>> So, if I built an internal site at my company for my employees to be able to access whatever it is, information about a very specific product or something like that, then I'm assuming that when my employee types in the private address, that it's going to the private resource I've created. But if the resolution or the resolver is broken, I could potentially also be going out to the public internet before that happens. Is that?

Joseph Hall

>> You could. It could be hunting for that information off of a public resolver. When it's local and internal, it should never do that. So the way you design your infrastructure is really important because you don't want to spill off data that is your private data. And more importantly too, you want to secure that. So, if you architect everything to do internal resolutions and then you run it through a DNS firewall, like some of the products we do with NNIOS-X and some of the other tools, you have the ability to inspect those resolutions. So we currently secure the majority of Fortune 500's for IP address management, DNS security, and DHCP. That gives us a very rich data set of DNS queries, and as we mark them and as other companies mark them and find them malicious, we're able to stop attacks at scale. So if an attack starts happening on the other side of the world, we're going to see that happening, gain intelligence off of that and be able to protect everyone else with it. And more importantly, what we've done is we've been able to write algorithms and predict what the bad guys are doing. So, we can hunt forward and we can see that they've got... Say they start building out their infrastructure. We know that these bad guys exist out there. And there's a quote, my dad always used to tell me, he says, "Show me your friends, they'll show you your future." So, bad guys like to hang out with other bad guys. So as they start touching those resources, and even worse, they start using each other's affiliates and they start subcontracting out different things that different bad guys are good at and they start affiliating with each other and connecting their websites. We'll start noticing that beginning to build up and then we'll start seeing their servers stood up that they look like spam cannons or there's bad infrastructure coming up. We can predict what's about to happen. So we're able to stop zero days before the zero-day. On average, we get it about two weeks ahead before the zero-day hits right now because we're able to see what they're doing.

Jackie McGuire

>> So, you're able to reduce risk through better job managing and inspecting and understanding DNS by both making sure that companies understand when they're transmitting sensitive data, the actual highways through the internet that that data is using to get to where it goes. And it's really interesting to talk about this in the... We're both a little old, so we were both from a time when servers actually did exist on somebody's computer, and if somebody turned off the wrong light switch in a closet, that website went down. And I think that's been abstracted so far, that we forget that even though we're using a cloud server, that's still a server running somewhere that has some information on it. And so, reducing risk with DNS looks both like understanding the actual pathways that your data is taking through the internet or to get to the resources you're asking for as well as, I suppose, and this is where you're going. I think we may have also at a societal internet society of the internet level been able to put you guys in the avoid category because once you start to understand the more nefarious roads that these attackers are taking through the internet, then you can start looking at where those roads go, I think is what you're saying and where they might be trying to go when they're taking them.

Joseph Hall

>> Yeah. It's a continuing process where we're always hunting and we're always reacting and we're trying to look ahead and predict what's about to happen. So, we're trying to avoid the risk in that sense, and we're reducing it with better architecture. So when you've got everything, when you're able to essentially manage all of your clouds together, we have our UDDI solution where we're able to manage like GCP, AWS, Azure, all these clouds, IP, DNS, DHCP infrastructure is one piece. We're able to gather all that telemetry together and you're able to architect a better faster solution so that you're not spilling this data publicly and that you're securing all of those transactions that are happening between your servers, between your clients, everything in both directions. So, most DNS security, it will only look for what's happening with the client, not in both directions. So you want to inspect that and you want to see what's happening in your network and you want to be able to maintain flows. DNS can be really noisy too, and if you misconfigure it, especially with security devices like firewalls, if you have older infrastructure, especially when used to build old web sense or where you're trying to filter content and you're adding all these manual domains through allow and block lists that can be resource intensive and it can query the firewall, your DNS infrastructure over and over again to figure out what these are. And if your lists get huge, especially with cloud infrastructures, that grew out, we saw an evolution of how firewalls and security devices dealt with DNS. Clouds grew exponentially quicker than they expected, and a lot of security providers were trying to provide security for say, Azure.com, and there are hundreds of thousands of servers on that site and IP addresses and everything that's got to resolve to. So if they have a really generalized object, it's going to just fill that database with stuff that one, it doesn't need. And two, it just is going to task that security device to be noisy and waste resources. So, a good infrastructure and good design, they've offloaded some of that where they'll figure out those bigger lists and then they'll hand those out as a list to the security device so it's not busy querying all your DNS infrastructure. So the architecture of it is really important in how you can save resources, especially in the cloud because you're paying for every bit of data in every direction that it moves in the cloud. So, if you're wasting time querying resources that you don't need to be querying because of poor infrastructure, you're wasting money and compute. So you want things to run quickly and efficiently. DNS is one of the noisiest things on your network, and it can be a hammer and it can go and stop all the bad guys, or it can lead to downfall. So you want to-

Jackie McGuire

>> Yeah. So not only does reducing risk with DNS look like effective DNS policies, but it also looks like effectively managing DNS so that the noise created by DNS doesn't bog down your signals from everything else and prevent you from finding other issues because you're dealing with an insane amount of DNS data.

Joseph Hall

>> Yeah. Yeah. It makes you hypnotized. Your SOP engineers, they're all human. They're just like everybody else driving a big car down the highway, and if it's the middle of the night and you're hypnotized by the same lanes going by over and over again, you're not going to notice things. So you want to reduce all that noise and you don't want to fatigue your security teams with useless alerts. So, a lot of that is knowing what's going on in the internet. And I worked with some of the most brilliant engineers I've ever met. Dr. Renee Burton is just an endless wealth of knowledge, and everyone on her whole team is just... I'm constantly learning something new and figuring a new way to look at something and analyze it, and we're at the bleeding edge of this stuff, and it's so cool to work for a team that is making a difference.

Jackie McGuire

>> Yeah. And I would be remiss if I didn't also just mention dangling sub-domains. So, I think one of the things that we're going to start seeing significantly more with this shadow IT created by a lot of AI projects is that one of the other real issues that I know we've talked about before and we've seen is that companies are not doing a good job controlling their DNS visibility within their own company, so actually, your company can end up with its own DNS issues because it's not doing a good job of controlling its own sub-domains. And I think you've actually dealt with some of those compromises as well. So, is this word salad or have you seen this as well, that as we start to try to make pieces of company websites accessible for AI projects, it's causing just as many issues?

Joseph Hall

>> Yeah, you're correct. And a lot of times, companies will have a fractured infrastructure where they'll have, sales will have their own websites so they can build, and marketing will have a bunch of their own sites they can build and who's managing the certificates between those? And then IT has their own, and there's a web dev team that has their own stuff too, and that, okay, well, who's managing all the DNS bills? Who's managing all the certificates? Who's managing the registrar information and are they with reputable registrars? There are some scammers that are going on right now where they'll sign up for free DNS registration accounts and they make it really easy for you, and they'll go and they'll register sub-domains of a domain that you own, and that resolver will come up for those sub-domains and they'll be able to get resolution off of a domain that you own. But because of the way that some of this stuff is architected and the standards of it all, there's not a way to stop this without fixing the standard. So this is a problem that you're going to have to deal with, and if you don't maintain your DNS, your certificates, your registrar information, you don't keep a good eye on that, you can be exploited. And people can take advantage of that, and then your brand is sitting on top of it and they're not even in your servers. They're doing this externally to you. So yeah, we've got some sitting ducks, decoy dog, we've got some great threat actors you can look at on a Infoblox threat Intel page where we go into great detail on this. So for any of your listeners that want to check that out, we've got wealth and knowledge.

Jackie McGuire

>> Yeah, I would highly encourage everybody. And I agree since I started following Dr. Burton and just all of the crazy brilliant people you work with, I've learned quite a lot as well about DNS. I think, again, it tends to be a little bit of a blind spot for some of us because it's not directly related to what we do, and we understand it because most of us have built websites, but it's not necessarily something that we're super familiar with. Joe Hall from Infoblox, thank you so much for coming on with me for the Art of Security Summit. The last thing that I want to talk about is we have, I think the event that we actually met at when we became besties, we met on a flight to RSA, so this is always a little bit of a friendship reunion for us.

Joseph Hall

>> .

Jackie McGuire

>> We've got RSA coming up next week. Anything you're particularly excited about? Any events you guys have? I'm sure you guys have a presence there, but how can we come find you other than looking for your always well-dressed suits?

Joseph Hall

>> We have a booth. We have a big green booth that you can't miss it. Yeah. And our team is putting on a lab training right now. I don't know if it's already all booked out or not, you'll have to check, but that lab is really interesting. So we focus on malicious ad tech, and that's what's becoming really prevalent as well with something called TDS Networks. So a website is able to identify who and what you are. One, I recently found when a child goes to the site, it'll play a little video game like the 404 T-Rex game that Google used to do. But then when they get a double score and they click the Easter egg, it installs malware on their phone or device. Or if it's an adult, it'll show them a toll road fee and it's like, pay $7 to pay this toll. Well, then they go through and they put their credit card and their driver's license info and all that thinking it's okay, and they hit enter to pay it, and then it automatically tries to reset their American Express account, sends them a six-digit code, and then the website's like, verify the code we just sent you and they put it in, then they lost access to their banking. So other sites, if a known researcher site or a sandboxing site looks up the domain, it'll show up as a parked domain and it'll look innocuous like it's for sale. So they're getting really good at hiding stuff, especially in all this malicious ad tech that leads you down these rabbit holes of bad guys. So definitely check out the labs that they're doing on that. It will help people identify how to find these networks and spot them. Everyone's been hit with the toll road text messages. Those ones are annoying, but they're fun to hunt.

Jackie McGuire

>> I had a conversation with the doctor about one of those yesterday, this older gentleman next to me, he said... Well, he was laughing. He's like, "This is from a UPS. I know this is fake." I was talking about the toll ones. He said, "Well, when I get those, I think I should click on them because I go visit my daughter." And I was like, "Sir, they also have your mailing address. If they text you and you don't answer, they will find you for your $3 toll. Don't worry, don't respond."

Joseph Hall

>> Yeah. The government will get their money.

Jackie McGuire

>> Yeah, yeah. They'll get their six bucks. Yeah. Awesome. Well, again, Joe, thank you so much. In addition to being one of my best friends, you are also one of the smartest people I know in security.

Joseph Hall

>> Thanks.

Jackie McGuire

>> Really appreciate you being part of the Art of Security Summit and look forward to catching up at RSA next week.

Joseph Hall

>> Let's go. See you there.

Jackie McGuire

>> Awesome. For theCUBE and SiliconANGLE, I'm Jackie McGuire and we will be back with more information about avoiding, reducing and transferring risk.

Joseph Hall, Stealth Infoblox

Jackie McGuire

Joseph Hall

>> Yes. Yes. That's what we're telling everyone right now.

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

>> .

Jackie McGuire

Joseph Hall

Jackie McGuire

Joseph Hall

>> Yeah. The government will get their money.

Jackie McGuire

Joseph Hall

>> Thanks.

Jackie McGuire

>> Really appreciate you being part of the Art of Security Summit and look forward to catching up at RSA next week.

Joseph Hall

>> Let's go. See you there.

Jackie McGuire

>> Awesome. For theCUBE and SiliconANGLE, I'm Jackie McGuire and we will be back with more information about avoiding, reducing and transferring risk.