Analysis: DHS Domain Name System Breach Directive

On January 22, the Department of Homeland Security (DHS) issued a directive to government agencies in response to breaches of the Domain Name System (DNS). The attackers used stolen credentials to alter DNS entries and steal certificates used for encryption and decryption. In combination, these actions let the attackers redirect sensitive traffic to their own sites, and to decrypt the traffic once it was received. DHS’s directive provides good advice for responding: audit DNS records & prioritize those related to critical services; change DNS account passwords; add multi-factor authentication to DNS accounts; and monitor and review certificate logs. The time frame for these actions is ten days, but MFA implementation can be postponed indefinitely with an explanation of why it cannot be implemented. DHS also warns, rightly, against the use of SMS-based MFA (i.e., the kind where a security code is texted to the user). Several questions arise. Do agencies have the tools and expertise to conduct these response activities? Do they have the infrastructure and software to implement MFA quickly? Why don’t these agencies have MFA on DNS accounts in the first place? Did affected agencies have strong controls in place on systems storing sensitive data while leaving DNS servers relatively unprotected? Can agencies correlate findings to validate the identification of perpetrators? After these initial tasks, affected agencies will need to determine what data was compromised and when, assess the impact of the breach, conduct forensic investigations to identify the attacker(s), and share that threat intelligence without creating a secondary risk. If Personally Identifiable Information (PII) was taken, victim notification will be necessary, and if covert operations of any kind were compromised, then safeguarding those human assets will be a top priority. Depending on the data stolen, other adjustments to operations will likely be necessary. Under the NIST Risk Management Framework (RMF), Federal IT systems are assigned an impact level of “High”, “Moderate”, or “Low”. The impact level determines the stringency of security measures implemented on those systems. Do all agencies assign the same impact level (and attendant security controls) to DNS systems? Is a review of impact levels appropriate, to ensure the appropriate safeguards are in place? This incident reveals: • The need for adequate identity protection, particular privileged accounts that should be protected by MFA • The need threat hunting and post-incident investigative tools and expertise • The need for an inconsistent assignment of impact levels to mission-critical systems such as DNS servers, or systems hosting DNS” DHS’ incident response capability has improved significantly in recent years, and for that, they deserve great praise.  The next phase is to concentrate on a harder task:  incident prevention.