Cyber Defense eMagazine February Edition for 2023

eport, domains with the terms “bitcoin” and “nft” were more likely to house phishing schemes. Ethereum
typosquatting domains favored cryptomining, with phishing a close second.
Between ransomware payments, phishing attacks, and cryptojacking, crypto is playing a huge role in the
threat landscape of 2022 and will have an even bigger part to play early next year. Because
cryptocurrency marketplaces are popular right now, threat actors have chosen to target a distributed,
easy-to-abuse threat vector that will always be attractive and remain difficult to regulate – the DNS layer.
In the event of an attack, DNS layer security serves as an organization’s first line of defense. Protecting
the DNS layer includes deploying security tools such as domain categorization, content filtering, and
advanced threat protection from web sites that are known to host dangerous content. If a user tries to
visit an unsafe web page and DNS security is enabled, the request to access the site will be denied at
the DNS layer, never reaching the enterprise network.
Shields Up at the DNS Layer Strategies
CISA is recommending that all organizations take a “shields up” approach to proactively defend against
active cyber security threats, and this certainly applies to DNS.
Some of the specific actions the agencies recommend include reducing the likelihood of a damaging
cyber intrusion, taking steps to quickly detect a potential intrusion, ensuring that the organization is
prepared to respond if an intrusion occurs, and maximizing the organization's resilience to a destructive
cyber incident.
For many businesses, DNS protection forms the backbone of their secure web gateway, as it is the
primary barrier against malware, ransomware, and phishing websites. It’s where policies for acceptable
use are configured and managed.
In legacy contexts, these two elements might be handled by a firewall. But with remote and distributed
workforces, it has become much more effective to use a DNS security tool as a secure web gateway.
With such an approach, organizations can detect and automatically block new DNS-based threats, create
and instantly roll out policies for web access and content filtering from a central location, and inspect DNS
packets used to communicate IP addresses.
DNS-related threats are a major concern for organizations today, as government agencies have made
clear. Protecting the DNS layer plays a pivotal role in securing every organization, as clicking an
untrustworthy link is the easiest way to engage with a cyber threat. Enterprises need to take steps to
address these threats to mitigate risk. A successful attack can shut down operations, steal vital
information and result in sizable costs. In the event of a cyberattack, DNS layer security acts as the first
line of defense.
Cyber Defense eMagazine – February 2023 Edition 141
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.