Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2010
01:27 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Report: Government Agencies Lag In DNSSEC Adoption

New report shows DNSSEC adoption slow within the .gov community, with many missing federal mandate deadline

Nine months have passed since the federal government's deadline for deploying DNSSEC, but only 36 percent of federal agencies' domains are authenticated with the DNS security protocol.

A new report from Internet Identity (IID) analyzed nearly 3,000 .gov domains in federal, state, local, and Native American agencies and found that DNSSEC adoption is making little progress. DNSSEC digitally signs DNS domains, which helps prevent cache poisoning attacks that intercept and redirect users' Internet requests to malicious or unintended sites.

Most federal agency domains in .gov are not being signed with DNSSEC, the report found; only 38 percent are doing so as of mid-September. Around 36 percent are fully authenticating their domains with DNSSEC, with 421 federal .gov domains out of a total 1,185. And 2 percent of feds' DNSSEC-signed domains are configured incorrectly and fail when DNSSEC checks are performed, the report found. IID also found that another 2 percent contain misconfigured DNSes.

"This should be a wake-up call that DNSSEC, likely for a multitude of reasons, is still not being implemented across a wide spectrum of .gov domains despite a mandate to do so," said Rod Rasmussen, president and CTO at IID, in a statement. And "even more worrisome, there is a small percentage of .gov domains that are adopting but not properly utilizing DNSSEC, leaving organizations with a false sense of security and likely problems for their users." Of all .gov domains, 15 percent were fully DNSSEC-signed and authenticated. On the state side, Idaho and Vermont have fully authenticated .gov domains with DNSSEC, and Virginia's domain name is fully DNSSEC-authenticated.

Overall, 40 percent of the .gov domains are federal agencies; 57 percent, state and local; 2 percent, Native American; and 1 percent, nonfederal or other types of organizations.

The report says the bottom line is that .gov's DNSSEC adoption is in the works but has missed its deadlines. "Much has been made about the difficulties of implementing an entirely different DNS standard that is highly complex and new to most administrators. The adoption and error rates for .gov deployment bear that out so far. Yet despite the difficulties, there are many success stories: highly sensitive domains for the FBI, the Federal Reserve, DHHS, and the DEA, along with hundreds more, are being fully signed and authenticated," the report says. "It appears that once a particular agency implements their DNSSEC plan, many or most domains controlled by that organization get signed."

A full copy of the IID DNSSEC report is available for download here (PDF).

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2002-0390
PUBLISHED: 2019-07-21
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2002-0639. Reason: This candidate is a reservation duplicate of CVE-2002-0639. Notes: All CVE users should reference CVE-2002-0639 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.