Using Facts to Disprove DNS Allegations

Let me start by saying I am always interested in finding new techniques. So if you have a way to resolve this problem I had today please drop me a note at secauditor(at)bigstring.com. Thanks!

Most of the time when an incident happens auditors or incident handlers are called in to try to track down the facts to prove something has happened. Today was an exception; I was called in to investigate improper use of corporate assets. Apparently the IT department was suspected of utilizing internal resources to host personal sites.

DNS Deployment – Split Split Environment

I recently provided a security review for a customer that revolved around their current deployment of BIND with a clustered DNS deployment and how I would recommend securing it to a higher degree. My recommendations focused around the implementation of a split-split DNS design.

This would create a multi level deployment between the Internal Network, DMZ and the outside world. This configuration is designed around a high availability, fault tolerant design, with the major drawback being that large amount of hardware required to implement it. This configuration necessitates the use of:

• Two Resolver DNS servers in a DMZ
• Two Advertiser DNS servers in a DMZ
• Two DNS servers internal on the local area network

There are two servers of each type to allow the fault tolerance and the load balancing. For each type of server DNS, there will be a primary and a secondary. There is zone transfers only between the primary and secondary servers.

Figure 1: Split-Split DNS