Protective DNS – Why It Matters and How to Deploy It On-prem
Talkat FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021 · 2021-12-07..12-09·
summary
Claims an on‑prem DNS firewall using RPZ blocks most new malicious domains in real time. Uses Bind RPZ on Ubuntu 20.04 (Raspberry Pi or VM), subscribes to an ioc2rpz feed and labs.fsi.io data, and loads ~8.6–13 million RPZ rules; deployment runs in about 10–15 minutes. Default policy returns NXDOMAIN for 24‑hour newly observed block, stopping a recent phishing click in minutes. Demo shows low CPU/memory on Pi, real‑time IXFR updates, and practical logs for incident response.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:16Protective Dns Why It Matters
- 9:55Who Controls Dns and Bgp
- 11:29Firewalls
- 26:01Protective Dns
- 27:12Ioc Indicators of Compromise
- 28:38The Dns Architecture
- 30:43How Would You Trust Your Cloud Dns Provider Not Being under Control of the Adversary
- 32:11Additional Protocols in Dns
- 52:14How Much Time It Would Take To Update a One Rule on Your Corporate Firewall
- 1:16:22Install Bind to Rpg
- 1:20:36Stress Test
- 1:28:19Memory Usage
- 1:34:58Raspberry Pi Configuration
- 1:59:50Newly Observed Domains
- 2:00:47Newly Observed Hosts
related talks
34mUsing DNS as a layer of defense
17mStrengthening security with DNS Firewall
44meBPF as an Active Security Enforcement Layer Stop DNS Data Breaches : Beyond Passive Observability
19mNames and Security
58mMultivariate Solutions To Emerging Passive DNS Challenges
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
34mPractical Steps for Reducing Exposure and Detecting Compromise
59mCatching Malware En Masse: DNS and IP Style