How a DNS Firewall Can Improve Networking Security for Your Business

Business is driven by the well-calculated balance between spending and earning, and even the most successful companies are in a constant search for ways to cut costs. But what’s often a “nice to have”  for larger companies can be a matter of survival for startups and small family businesses, who are usually only able to spend money on the essentials.

Yet the scope of these essentials changes yearly. In 2020, as more businesses move online, they’re finding that it’s crucial to safeguard their cybersecurity, even if their activities are far removed from the tech sector. To get optimal protection without paying for unnecessary services, it’s important to analyze the most common types of cybersecurity attacks--in order to build solutions that protect against them.

The biggest online threats that affect all businesses

There are hundreds of reports about the current top threats to cybersecurity, but most agree that the most common attacks rely on Artificial Intelligence and social engineering to exploit Cloud and IoT vulnerabilities. Cybercriminals are also becoming increasingly adept at combining novel technologies with their knowledge of human psychology. 

For instance, phishing scams, one of the top threats in recent years, have evolved from straightforward schemes into very subtle approaches that play on our feelings of compassion--so that we willingly reveal confidential or personal information, or simply transfer our money to an unknown bank account.

Scammers, for example, can pretend to be charity organizations and take advantage of current events--such as natural disasters or health scares--to persuade us to give money to a seemingly good cause. The recent coronavirus pandemic has given rise to a colossal wave of phishing attacks: Google is reportedly being forced to block over 18 million hoax emails daily from fraudsters pretending to be affiliated with governments, the World Health Organization, or other high-ranking officials.

DNS attacks

At the same time, according to Cisco’s 2020 Security Report, DNS-based malware is rapidly emerging as one of the most common cyber threats. This is hardly surprising, as DNS, or the Domain Name System, is one of the most critical internet services. It’s the key component that allows your computer to show you content, by translating IP addresses into human-readable domain names and back. Email services, chat services and social networks all rely on DNS in order to function.

How DNS attacks work

Today’s DNS attacks come in numerous and fairly complex varieties, from the much-talked-about DDoS attacks to cache poisoning. These attacks typically take advantage of the plain text communication that’s transmitted between client devices and servers, but may also involve logging into a DNS provider's website using stolen credentials in order to redirect DNS records.

In this way, attackers can transfer DNS zones, modify DNS resolvers to report different IP addresses, and redirect web and email traffic. Most importantly, when this happens website visitors don’t even know that their traffic has been redirected to another server.

How to protect your business

There are several ways a company can protect itself from a DNS attacker. However, most of these are highly technical and require specialized knowledge or the support of an IT expert.

These include:

• auditing your DNS zones;
• keeping your DNS servers up to date;
• restricting zone transfers;
• implementing two-factor authentication;

and, most importantly, carefully configuring your DNS servers to hide vulnerable data and prevent DNS recursion.

If you lack the means to do it yourself, you can find several off-the-shelf products that curb DNS-related threats. Large companies like Cisco offer comprehensive solutions to protect corporate networks. Cisco Umbrella, for instance, is a Cloud-based security service, which offers DNS-layer protection for large corporate networks that have numerous connected devices. However, like many enterprise-scale solutions, it is quite pricey.

For smaller businesses and startups that don’t have extensive infrastructure, it’s often more feasible to set up a DNS Firewall: a tool that offers robust protection against DNS attacks, but at a lower price point.

How a DNS Firewall works

A DNS Firewall is a security solution that relies on a vast database of known malicious Internet locations--such as domain names, IP addresses, and name servers--to shield a device from receiving DNS requests from malware sources. When malware tries to hijack the device’s DNS, the Firewall intercepts the DNS resolution that may come from a suspicious website and blocks that website, making it invisible to the end user.

A DNS Firewall can also protect you from phishing websites that hunt for your passwords or other sensitive data by pretending to be legitimate sites. Drawing on an extensive database of these malicious websites, a DNS Firewall detects and blocks all phishing links even before the user has opened the webpage.

To give you full control over the content you access on your device, a DNS Firewall lets you block unwanted content by category, the most common of which are gambling sites, adult sites, and unwanted e-commerce sites. It also enables you to manually blacklist specific domains.

What are the benefits of a DNS Firewall for startups?

The biggest benefit is fairly obvious: You get robust security that’s  within your budget. Just by activating a DNS protection tool, you can fend off most malware attacks.

A secondary benefit is that by blocking pop-up windows with undesirable content, you also cut out unnecessary traffic and keep your broadband connection clear.

When looking for the right DNS Firewall solution, there are a range of options that also include integration with VPN-based security services. This can be essential for small businesses or startups that are looking for a simple way to secure their office networks and devices.

It can also help geographically distributed teams to access network resources more safely, which is increasingly important as businesses increasingly move online. With a combination of VPN and DNS-based solutions, it’s possible to achieve near-total control of your business’s online security and privacy, regardless of the size of your enterprise.