Cyber Defense eMagazine February Edition for 2023

Section 3553(h) of title 44, U.S. Code, authorizes the Secretary of Homeland Security, in
response to a known or reasonably suspected information security threat, vulnerability, or incident
that represents a substantial threat to the information security of an agency, to “issue an
emergency directive to the head of an agency to take any lawful action with respect to the
operation of the information system, including such systems used or operated by another entity
on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise
maintains agency information, for the purpose of protecting the information system from, or
mitigating, an information security threat.”
Federal agencies are required to comply with these directives.
The Emergency Directive was hot on the back of 33 days of disruption that caused many of the Federal
Agencies Internet Assets to be shut down. This incident was unequivocally connected to discovering
DNS tampering. Let us briefly cover what DNS is as it is nothing new, but critical to security.
DNS was designed and developed by Dr Paul Mockapetris between 1983 and 1986. DNS became
adopted globally as one of the first Internet Protocols. Put simply, DNS allowed people to use the alphabet
to recall website addresses. This was then translated by DNS into binary numbers for computers to use,
share, and distribute.
A website address like Google.com typically has IPv4 addresses such as 172.217.14.78. The IPv4
address is a unique string of numbers punctuated by dots. The later IPv6 addresses are a series of
hexadecimal characters and colons. Because the Internet is extremely dynamic, both IP addresses and
domain names can change. DNS is adapted to record and reflect these changes, so it can successfully
do its job of converting text domain names into IP addresses. DNS accommodates both IPv4 and IPv6
addresses.
DNS Abuse and Attacks are nothing new. DNS manipulation has been successfully used by the U.S.
Government to monitor data flow and if deemed suspicious, has the ability to capture and review the data
‘packets.’
Following the atrocities of 9/11, DNS tampering became more widely, and more frequently used. There
are numerous papers dating back to the early 2000’s that share information and concerns of the lack of
DNS controls, management, and governance. This led to not only a heightened awareness of the already
near 20 years old Internet Protocol, but also highlighted the ability to Abuse and Attack DNS by our
adversaries. Put simply, DNS became more akin to the Wild West than a Protocol to ensure stability and
data flow correctness. This free-for-all led to the Emergency Directive 19-01.
Unfortunately, the majority of Federal Agencies were unable to comply with the Emergency Directive due
to a lack of knowledge, capability, and skill within the field of DNS. CISA offered to support the Ten-Day
Directive deadline with the various Federal Agencies. However, CISA’s own DNS record was, and is, like
the majority of Federal Agencies, far from optimal today.
Cyber Defense eMagazine – February 2023 Edition 107
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.