{"id":3064,"date":"2025-03-12T15:40:25","date_gmt":"2025-03-12T14:40:25","guid":{"rendered":"https:\/\/ukotek.com\/?p=3064"},"modified":"2025-03-13T17:45:17","modified_gmt":"2025-03-13T16:45:17","slug":"proteccion-dns-anticiparse-para-no-reaccionar-tarde","status":"publish","type":"post","link":"https:\/\/ukotek.com\/en\/proteccion-dns-anticiparse-para-no-reaccionar-tarde\/","title":{"rendered":"DNS protection: anticipate so as not to react too late\u00a0"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tell him <\/span>goodbye<\/span> at <\/span>umbrellas, go out<\/span> the sun<\/span><\/span>\u00a0<\/span><\/strong><\/p>

How do you prevent what is meant to come from not coming? The best way to avoid impact is to get ahead of it. To do this, we need a security strategy <\/span>proactivenot only reactive.<\/span>\u00a0<\/span><\/p>

The first step in anticipation is to understand how the attacker operates. Because if there is one thing that characterises cybercriminals, it is their <\/span>persistence. The data confirms it: more than 200,000 domains are created every day, and the number of new domains is <\/span>85% has malicious purposes<\/span><\/b>. In addition, the <\/span>92% of the malware<\/span><\/b> relies on DNS to deploy its attacks. Doing the numbers, this means that <\/span>two domains are born every second designed to attack<\/span><\/b>. And, of course, any of them can target your company.<\/span>\u00a0<\/span><\/p>

If we analyse the most used domains, we find a surprise: the most registered TLD <\/strong><\/span>no<\/strong> is neither .com nor .net, but .tk,<\/strong> a domain associated with Tokelau, a small self-governing territory in New Zealand with a population of just 1,400. A curious but revealing fact: cybercriminals take advantage of poorly controlled domains to launch attacks such as the <\/span>IDN homographby spoofing legitimate URLs with similar characters, which are difficult even for machines to detect.<\/span>\u00a0<\/span><\/p>

The limitation of traditional solutions<\/span><\/b>\u00a0<\/span><\/h2>

Until now, the traditional approach has been to protect the DNS with blacklists of known malicious domains. But there is an obvious problem: if 30 new domains have been created in the last minute for illegitimate purposes, <\/span>How can a static list identify them in time?<\/span><\/b><\/p>

It simply cannot.<\/span>\u00a0<\/span><\/p>

Most of the solutions on the market follow a model of <\/span>detection and response. However, if we really want to stay ahead of the attacker, we need to understand their strategy. and anticipate their movements.<\/span>\u00a0<\/span><\/p>

A smart strategy: early detection with AI<\/span><\/b>\u00a0<\/span><\/h2>

The attacker often throws a stone and hides his hand, so he uses a TDS (<\/span>Traffic Distribution System<\/span><\/i>) to distribute its malicious content over the network, but it stipulates that it does so under certain conditions. In other words, it gets the <\/span>malware<\/span><\/i> only in the case where the victim is of interest to them.<\/span>\u00a0<\/span><\/p>

In five of the seven steps of the <\/span>Cyber Kill Chain<\/span><\/b>the attacker needs to use DNS. Why not turn it into a strategic control point? That's where<\/span>\u00a0Threat Defence<\/span><\/b> from Infoblox<\/a>.<\/span>\u00a0<\/span><\/p>

Thanks to artificial intelligence and machine learning, this solution does not only detect malware <\/span>before it is activated<\/span><\/b>Instead, it identifies suspicious patterns of behaviour in real time. Instead of relying exclusively on blacklists, <\/span>parses the 100% of DNS traffic<\/span><\/b> -both incoming and outgoing- blocking threats before they become a problem.<\/span>\u00a0<\/span><\/p>

For example, when an attacker registers a domain just before an attack or reactivates an old domain in order to go unnoticed, <\/span>Infoblox Threat Defence<\/a> detects it almost in zero time<\/span><\/b>. With only one <\/span>0,002% of false positives<\/span><\/b>AI makes it possible to anticipate emerging malicious domains with unprecedented accuracy.<\/span>\u00a0<\/span><\/p>

In addition, the solution identifies <\/span>fake domains or \"lookalikes<\/span><\/b> used in fraud, through a massive daily analysis of DNS patterns.<\/span>\u00a0<\/span><\/p>

Real impact on your organisation<\/span><\/b>\u00a0<\/span><\/h2>

Adopt Infoblox<\/a> Threat Defense not only improves security, but also optimises the operation of your team:<\/span>\u00a0<\/span><\/p>