Welcome!

Blog Feed Post

Ultra AEP warns of on-going danger of ‘dirty domains’

Only 53 per cent of global top level domains 'secure'

Loudwater, UK, 23rd January 2014: Over three years after the world's first top level domains (TLDs) (such as .org, .com and .net) were signed with domain name system security extensions (DNSSEC), nearly half (47 per cent)[1] remain open to malicious tampering. This is potentially leaving millions of the world's internet users open to malicious redirect to fake websites, warns FTSE 250 cyber security company Ultra Electronics AEP.

Some of the world's most advanced Internet economies such as Italy (.it), Spain (.es) and South Africa (.za) remain unsigned, leaving every Internet visitor to a website ending with that extension at risk of being re-routed to a bogus website and potentially being fooled into parting with personal information.

Sonia Freed, Managing Director of Ultra Electronics AEP explains: "This is an issue that affects every Internet user in the world and a poor level of take up of DNSSEC amongst top level domains is a barrier to the evolution of a safer Internet. Unless the top level domain is signed, every single website operating under a national domain can have its DNS spoofed, potentially directing Internet users straight into the hands of cyber criminals via fake websites that often look just like the real thing."

Freed continues: "Whilst many of the domains we are familiar with such as .com, co.uk and .org are secure, it's becoming increasingly common for websites to use extensions from other countries even when they do not have a local presence. Many popular file sharing sites for instance use unsecured domains from tiny Caribbean islands and are using them as a 'flag of convenience'. With this fragmentation, comes potential confusion and an environment in which cyber criminals can thrive."

Richard Lamb at Internet Corporation for Assigned Names and Numbers (ICANN): "It is now three and a half years since the root of the Domain Name System was signed, however our figures show there is still a great deal of work to do. DNSSEC is a leap forward in preventing attackers from redirecting end users to websites under their own control (for account and password collection). We urge the owners of the remaining unsigned TLDs to work with ICANN and help develop a safer web to protect the world's internet users."

Freed highlights the scale of the problem: "DNS cache poisoning continues to affect the world's Internet users. Towards the end of last year, users of Google's Malaysian domain (www.google.com.my) were directed to a fake website in Pakistan.[2] The Syrian Electronic Army (SEA) have also exploited DNS weaknesses to modify DNS entries and redirect users accessing The New York Times and Twitter to propaganda pages."

Freed notes: "Securing the TLD is a major first step but it's also necessary for responsible individual domain name owners to ensure the integrity of their zone data and hence the integrity of their associated web services by implementing a DNSSEC solution and signing their zone DNS resource records. A DNSSEC solution comprises a DNS Server with DNSSEC extensions and cryptographic keys."

DNSSEC uses public key cryptography to digitally sign DNS data. It means that responses to DNS queries are digitally signed by the DNS server using private keys and are automatically verified by the client using the corresponding public key.

Digital signing also guarantees the validity of DNS responses. As such Internet users are protected from the fraudulent DNS responses that could contribute to phishing techniques and other forms of fraud. Using a hardware secure module (HSM) can enhance the security of a DNSSEC solution. In addition to highly secure key generation and storage, HSMs provide fast cryptographic processing, which offload computationally intensive calculations from servers.

AEP Keyper is the only network-attached HSM on the market certified to FIPS 140-2 Level 4 overall, the highest FIPS accreditation.

For further information, please see: http://www.internetsociety.org/deploy360/dnssec/

[1] Figures published by Internet Corporation for Assigned Names and Numbers (ICANN) on 20.01.2014: http://stats.research.icann.org/dns/tld_report/index.html
[2] Source: MYNIC (official registrar of Malaysian internet domains): http://mynic.my/en/news.php?id=162

-Ends-

Notes to editors
On June 16, 2010, AEP Ultra Safe Key Security and Management product signed the DNS root of the internet, the dot, forming part of an elite international circle of trust protecting the web from being hijacked - See more at: http://www.ultra-aep.com/company-overview#sthash.G3DUZ1Q3.dpuf

About Ultra Electronics AEP
AEP provides trusted security everywhere and develops the highest grade security and communication technologies, securing data regardless of device, environment or location, tested and accredited to industry security standards, including FIPS 140-2 Level 4 and CAPS to IL3/IL4. Trusted by businesses, governments and the defence sector, its extensive portfolio of products and solutions protect the integrity of very sensitive data and are extremely reliable, survivable and resilient. AEP is a business unit of Ultra Electronics an internationally successful security, defence and aerospace company with a long, consistent track record of development and growth. Ultra businesses constantly innovate to create solutions to customer requirements that are different from, and better than competitors.

Enquiries
John Bailey, Marketing Manager 01628 642600
David Bell, Vocal Public Relations 07971 845740

Source: RealWire

Read the original blog entry...

More Stories By RealWire News Distribution

RealWire is a global news release distribution service specialising in the online media. The RealWire approach focuses on delivering relevant content to the receivers of our client's news releases. As we know that it is only through delivering relevance, that influence can ever be achieved.

Latest Stories
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
Sanjeev Sharma Joins June 5-7, 2018 @DevOpsSummit at @Cloud Expo New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...
"I focus on what we are calling CAST Highlight, which is our SaaS application portfolio analysis tool. It is an extremely lightweight tool that can integrate with pretty much any build process right now," explained Andrew Siegmund, Application Migration Specialist for CAST, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
As many know, the first generation of Cloud Management Platform (CMP) solutions were designed for managing virtual infrastructure (IaaS) and traditional applications. But that's no longer enough to satisfy evolving and complex business requirements. In his session at 21st Cloud Expo, Scott Davis, Embotics CTO, explored how next-generation CMPs ensure organizations can manage cloud-native and microservice-based application architectures, while also facilitating agile DevOps methodology. He expla...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone inn...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive ov...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
DevOps promotes continuous improvement through a culture of collaboration. But in real terms, how do you: Integrate activities across diverse teams and services? Make objective decisions with system-wide visibility? Use feedback loops to enable learning and improvement? With technology insights and real-world examples, in his general session at @DevOpsSummit, at 21st Cloud Expo, Andi Mann, Chief Technology Advocate at Splunk, explored how leading organizations use data-driven DevOps to close th...
Continuous Delivery makes it possible to exploit findings of cognitive psychology and neuroscience to increase the productivity and happiness of our teams. In his session at 22nd Cloud Expo | DXWorld Expo, Daniel Jones, CTO of EngineerBetter, will answer: How can we improve willpower and decrease technical debt? Is the present bias real? How can we turn it to our advantage? Can you increase a team’s effective IQ? How do DevOps & Product Teams increase empathy, and what impact does empath...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software. They hope to capture value from emerging technologies such as IoT, SDN, and AI. Ultimately, irrespective of the vertical, it is about deriving value from independent software applications participating in an ecosystem as one comprehensive solution. In his session at @ThingsExpo, Kausik Sridhar, founder and CTO of Pulzze Systems, discussed how given the magnitude of today's application ...