This blog is the third in our series on Reporting and Analytics, following the Top 5 Reports that Increase Network Visibility & Make You a Better Manager and Why You Need Reporting & Analytics with Query Logging. In this installment, I’m going to share the Top 7 Security Reports that Help You Level the Playing Field Against Bad Actors.
Why Network Security Reports are Essential to Your Enterprise
Quite simply, the sheer number of targeted and complex cyber-attacks is on the rise. In 2017, there were a total of 612 publicly disclosed data breaches, exposing over 1.9 billion records (Privacy Rights Clearinghouse). Ransomware damages were $7 billion in 2017, up 600% from approximately $1 billion in 2016 (Cybersecurity Ventures). During that time, researchers found that 80 to 90 percent of all new malware is unique, designed to attack just one individual system. Further research shows that 72% of organizations believe that cybersecurity operations have become more difficult over the past 2 years, yet 51% of organizations are plagued with a shortage of cybersecurity skills (ESG Research).
Increasing Threat of DNS Exfiltration
If you operate Internet commerce or informational website, you depend on your underlying DNS services. In recent years, DNS services were used in some well-publicized breaches (Dyn, 2016, UK National Lottery, 2017, Boston Globe, 2017 and many others), where vulnerabilities have enabled data exfiltration attacks to succeed.
DNS protocol enables a client to submit queries to and receive replies from an external server, but there is no message-level security enforced in typical DNS services. It offers an easy way for attackers to disrupt services, infiltrate malware into the network or exfiltrate sensitive data from your company. DNS attacks are historically categorized as a distributed denial of service (DDoS), DNS high-jacking or man-in-the-middle attacks. (“Securing DNS to Thwart Advanced Targeted Attacks and Reduce Data Breaches“). The diagram below outlines how a typical DNS exfiltration attack is conducted.
Source: Adapted from SANS Institute, Securing DNS Against Emerging Threats: A Hybrid Approach, John Pescatore, March 2017
While DNS attacks are on the rise, the good news is that enterprise-class secure DNS solutions can level the playing field and get network and cybersecurity teams back in the game. Comprehensive network visibility, access, and timing are critical. A critical part of these solutions includes Reporting and Analytics tools integrated with DNS, DHCP and IPAM (DDI) to deliver the visibility you need and the real-time knowledge and insight that can give you the advantage over bad actors attempting to infiltrate or exfiltrate your network. These are essential for keeping your network safe and brand and favorable reputation intact.
The Top 7 Security Reports to Fight Against Cyberattacks
Infoblox DDI engineers have analyzed and pre-built a significant number of customizable, out-of-the-box reports over the years with feedback and analytics insights from customers, architects, administrators, SMEs, SEs, sales, and others. Built on the Splunk reporting and visualization engine, these reports can be accessed through security dashboards, customized as needed, exported as a .pdf, scheduled to run and be distributed in advance to give you the intel you need with minimal effort. They’ve been gathered into a collection and made available to Infoblox customers through the Sample Report Guide. Let’s look now at the top 7 Security reports and how they can help you detect network attacks as they happen, not at the end of the malware cycle when the damage is done. As an existing Infoblox customer, you can have access to these powerful, real-time network reports today through a Free Tier trial in as little as 20 minutes, to give you the intel you need, save time and money and improve the way you manage.
Here are the seven (7) security reports that can give you an edge over the bad actors.
- Top Report #7: DNS Top NXDOMAIN – NOERROR
- Top Report #6: Threat Protection – Top Rules by Source
- Top Report #5: Top Malware & DNS Tunneling by Client
- Top Report #4: Tunneling Traffic by Category
- Top Report #3: DNS Top Tunneling Activity
- Top Report #2: Malicious Activity by Client
- Top Report #1: DNS Top RPZ Hits
Learn more:
- Join the Infoblox Reporting & Analytics Technical Demo Series to continue the discussion in the free webinar on 7/17, 2018, 9A PDT, 12P EDT, 5P BST. Register
- As an existing Infoblox DDI customer, you can deploy a virtual Infoblox Reporting & Analytics appliance free of charge — no strings attached. Download and try the Reporting & Analytics Free Tier today.
