Protecting The Network via A Secure DNSDNS Summer Day 2017
Amanda Constant, VP Engineering, Secure640Introduction
Amanda Constant – Secure64 Vice President of Engineering•••••

MS Computer Science – University of Arizona 1984
33+ years experience in Software Engineering
11 Years at Secure64
Secure64 Representative to DNS OARC
Responsible for all R&D, Current Product Engineering,
Product Test, On Call Support Specialists

Summary
Performance
PriceSupport

Product name(s)DNS Cache, DNS Authority, DNS Manager, DNS Guard, DNS Signer, Private Certificate Authority, ENUM
Solutions, DNS Analytics, Pipe-Protector, ProVisionConcept

Highly-secure, always available, set-and-forget DNS, Industry leading innovations on top of DNS as a platformto protect the network and subscribers

Strengths

Built-in DDoS protection (including PRSD), immune to BIND vulnerabilities, carrier-grade availability, IPv6 andfully automated DNSSECFunction

Authority, cache, DNSSEC servers, provisioning, monitoring & management, network protection services

Format (HW/SW)

Software, virtual appliance, hardware appliance, NFV ready

Authority server

1M+ Zones

Cache server

1M+ QPS (HPE DL360 gen9 server with a single Intel® Xeon® Processor E5-2667 v4 (25M Cache,3.20 GHz), 16GB of RAM, anda two port HP530SFP+ (QLogic 57810S) 10Gb network card.
Pricing model

Cache: QPS-based Authority: Records-based Pay-as-you-Grow

Minimum upfront cost

From $7,500

Running costs

From $3,000 Annual

Support structure

Japanese language support via Local Partner NSSOL

CVE response

Japanese language Email Announcement via Local Partner NSSOLEOL policy

2 previous generations supported

Data migration

RFC1035(BIND) formatted zone files translator

Local zone save?

Y

PRSD defense?

Y (Rate Limit[Client → Cache], Rate Limit[Cache → Auth], Internal resource monitoring &protection

Cache poisoning defense?

Y Source port randomization; dns-0x20; bailiwick checks; QID, QName,DDoS defense?

Y RRL, Mitigation on: RRTYPE, per IP rates, aggregate rates, response codes, protocols

Supported RR TypeAll RFC types

IPv6 transport support?

Y Including DNS64 and filter-AAAA-on-V4
Web GUI, CLI, REST API

Integrated management?

Y Manage, monitor, alert/alarm on multiple platforms from a single DNS Manager instance(remote login & command execution)

Logging?

Query log, command audit logs, negative response logs, blacklist logs

Query log search?

GUI, CLIAuthority

InterfaceCache

Management

Text file, binary, SQL database

DNSSECFeatures

Zone data save format

Signature update

Y (automatic)

Key update

Y (automatic)

Key update format

ZSK:Pre-Publication, KSK:Double-Rrset

HSM support

Y – Keys are never in the clear

Validation

YTA update

Y (RFC5011 support)

NTA supportYWho We Are• Founded by Hewlett Packard veterans in 2002
• Based in Denver, Colorado• Built on a foundation of security• Secure platform for DNS• Built-in DDoS protection• Carrier-grade availability• Growing 50-60% annually• Tier-1 ISP and carrier customers• Offices in USA, Europe and Japan

Key Customers and Verticals
Communications

Government / EnterpriseInternet Infrastructure
Automated DNSSEC

5

Secure64 Product Line
ProVision

Service Provision

Security Services

Monitor & Alarming

DNS Engines

Secure Platform

Network resource automationand provisioning

Malware
Guard

Fraud
Guard

ENUM
MNP Query & Subscriber
Provisioning

ContentGuard

Regulatory
Compliance

DNS Manager
Centralized DNS Management, Analytics, Real Time Monitoring andIntelligence, Reporting and Administration

DNS
Cache

DNS
Authority

DNS
SignerScalable, carriergrade DNS
resolverHigh performance,
authoritative DNS

Automated, secure
DNSSEC

SourceTx86 Secure Linux

Secure micro kernel

Secure kernel,
Full Virtualization Support

BIND Vulnerabilities – Secure64 is not based on
BIND
Critical BIND Security Vulnerabilities
Requiring Immediate PatchingYear

10982016

7654322017

102011

2012

2013

2014

2015

Secure64 is not vulnerable to any of these BIND weaknesses

BIND

Secure64 Vulnerability Impact
ID
CVE-2016-1284
nnCrashCVE-2016-1285
nnCrashCVE-2016-1286
nn
Crash
CVE-2016-2088
nn
Crash
nn
Crash
CVE-2016-2775
nn
Crash
CVE-2016-2776
nn
Crash
CVE-2016-2848
nn
Crash
CVE-2016-6170
nn
Crash
CVE-2016-8864
nn
Crash
CVE-2017-3135
nn
Crash
CVE-2017-3136
nn
Crash
CVE-2017-3137
nn
Crash
CVE-2017-3138
Not vulnerable
Vulnerable

Secure64 is not vulnerable to any of these BIND weaknesses

Secure64 Built-In Defenses
Resource Exhaustion

All Network Traffic

Volumetric DDoS (amplified flood)

Level 1
ProtocolExploit
Protection

Level 5
Level 2
TCP SYN Flood
Protection

Level 3
DNS Packet Filter

Level 4
UDP/TCP Flood
Protection

Bandwidth
Exceeding
UDP/TCP Flood
Protection

Level 6
DNS
Clean Application
Traffic Protection“The Secure64 software was subjected to a number of attacks known to be
disruptive to servers, and ignored the attacks, delivering information as requested up
to the saturation point of the Gigabit connection used.”Overload Defenses in Action vs. PRSD
CPU

Normal Production View

PRSD Attack without Overload
Defenses

Queries inProgress

PRSD Attack with Overload
Defenses

Consolidating IP Addresses with Anycast
Telecom Provider BEFORE
SU1 Auth/Cache
ns1.customer1.net•Security• Combined Roles (Auth/Cache)• If Cache is attacked, Authority
goes down

SU2 Auth/Cache
ns2.customer1.net

SU3 Auth/Cache
ns3.customer1.net

IP: 2.2.2.2

IP: 1.1.1.1

IP: 3.3.3.3

SD1 Auth/Cache
ns.customer4.net

ST1 Auth/Cache
dns.customer2.net

IP: 9.9.9.9
IP: 12.12.12.12
IP: 13.13.13.13

IP: 4.4.4.4•

IP Space Used
• 13 unique IP addresses

SD2 Auth/Cache
ns2.customer4.net

ST2 Auth/Cache
dns2.customer2.net

Internet

IP: 8.8.8.8
IP: 10.10.10.10

IP: 5.5.5.5

IP: 11.11.11.11•

Cost• 9 BIND servers (powerconsumption, patching andmanagement)

IP: 7.7.7.7

SF1 Auth/Cache
ns1.customer3.net

IP: 6.6.6.6

SF2 Auth/Cache
ns2.customer3.net

Consolidating IP Addresses with Anycast
Telecom Provider AFTER
S64-1 Auth Masterns1.customer1.net IN A 1.1.1.1
ns1.customer3.net IN A 1.1.1.1
ns1.customer4.net IN A 1.1.1.1
dns.customer2.net IN A 1.1.1.1

Zone
Transfers

eth0: 4.4.4.4

lo1: 2.2.2..2

eth0: 3.3.3.3

lo1: 1.1.1.1Security• Separate Cache DNS andAuthority DNS• Remove BIND vulnerabilities
from network•

IP Space Used
• 7 unique IP addresses (vs. 13)•Cost• 4 Secure64 DNS servers (vs. 9)• Less power consumption• Centralized management with
DNS Manager• No CVE Patching

S64-2 Auth Slave
ns2.customer1.net IN A 2.2.2.2
ns2.customer3.net IN A 2.2.2.2
ns2.customer4.net IN A 2.2.2.2
dns2.customer2.net IN A 2.2.2.2

InternetInternet
S64-3 Cache•

Anycastlo1: 10.10.10.10

Anycastlo1: 10.10.10.10

eth0: 9.9.9.9

eth0:
11.11.11.11

S64-4 Cache

Secure64 – Benchmark Leader

DNS Manager for NMS

Deployment Model – Network Function Virtualization
Orchestrator
OSS/BSSVNF 1

VNF 2RVNF 3REST APIREST APIREST APIDNS App 1

DNS App 2

DNS App 3

Guest OS

Guest OS

Guest OS

Virtual Network

Virtual Compute

Virtual Storage

Virtualization Layer
Network HWCompute HW

Storage HW

VNF Manager

Ve-Vnfm automatically:• Configures• Monitors• Controls• Provisions

Benefit
Maximizes performance

Ve-Vnfm

Virtualized
InfrastructureManagerReduces CAPEX✔

Reduces HW OPEX✔

Reduces SW OPEX✔

Accelerates time to market✔

Increases agility & flexibility✔

Secure64 in Summary• Not vulnerable to BIND CVEs
• Built in DDoS protection, including PRSD & overloadattacks• Carrier-grade availability• IPv6 compatible• Fully automated DNSSEC• Network security innovations utilizing a secure DNS• Simplified DNS architecture reduces operational costs• NFV ReadyThank you