SECURITY

Tool Improves Security and Understanding of DNS Configurations

Rebecca Kutzer-Rice | Date: 01-23-12 | Comments

Researchers have created a tool to improve the effectiveness of a federally mandated DNS security mechanism. Called DNSViz, the tool could increase IT workers� understandings of how complex DNS configurations work and lessen vulnerabilities from malicious third-party attackers.

Researchers at Sandia National Laboratories have created a tool to aid government IT workers fix problems with Domain Name System Security Extension (DNSSEC), a government-mandated security feature required for all .gov sites.

The Domain Name System (DNS) translates the hostname of a URL into an IP address, and therefore it is necessary for everything from Web browsing to checking email. DNS can be insecure because third-party attackers can go unnoticed.

Casey Deccio designed the new visualization tool to help IT workers better understand DNS configurations.

DNSSEC improves the security of DNS because it enables applications like Web browsers and email software to verify that their IP addresses have not been tampered with for malicious reasons. Since 2008, White House's Office of Management and Budget (OMB) has required DNSSEC for all federal information systems. Unfortunately, DNSSEC is difficult for government systems to use.

"DNSSEC is hard to configure correctly and has to undergo regular maintenance," explained Casey Deccio, a computer scientist at Sandia, in a statement. "It adds a great deal of complexity to IT systems, and if configured improperly or deployed onto servers that aren't fully compatible, it keeps users from accessing .gov sites. They just get error responses."

Deccio�s new tool, DNSViz, is "tool for visualizing the status of a DNS zone." It depicts the DNSSEC authentication chain, while highlighting and describing errors that it detects. This simplifies DNSSEC configuration and administration.

The current version of the tool works as a Web interface. Deccio hopes to expand it with alert mechanisms and application programming interfaces (API). Eventually, it could continuously monitor DNS health and security.

Deccio is testing DNSViz on the Sandia servers in California, where the tool monitors 100,000 DNS names. Several times each day, it successfully analyzes the organization�s DNS configurations.