DNS attacks rise in the UK

EfficientIP has published the results of its 2021 Global DNS Threat Report. The annual research, which was conducted in collaboration with leading market intelligence firm International Data Corporation (IDC), sheds light on the frequency of the different types of DNS attack and the associated costs for the last year throughout the COVID-19 pandemic.

In the United Kingdom, the damages stemming from each attack saw a marked decrease by 27% from the year prior; damages in 2021 were £530,659 (€596,083), while damages in 2020 were an average £729,131 (€819,024). This was the  strongest decrease globally. The UK companies in the survey reported an average of 5.78 attacks in the last year, which is also the lowest average reported (the highest number was 7.74 in Canada). 

In terms of regional damage from DNS attacks, Europe suffered an average of £662,271 (€743,920) per attack. This is a slight increase by 3% from the year prior.

Globally, nearly 90% of organizations (87%) experienced DNS attacks, with the average cost of each attack around £693,507 (€779,008). The Report shows that organizations across all industries suffered an average 7.6 attacks this past year. These figures illustrate the pivotal role of DNS for network security, both as a threat vector and security objective. 

The 2021 DNS Threat Report has found that, throughout the past year during the pandemic, attackers have increasingly targeted the cloud, profiting from the reliance on off-premise working and cloud infrastructures. Around a quarter of companies have suffered a DNS attack abusing cloud misconfiguration, with almost half of companies (47%) suffering cloud service downtime as a result of DNS attacks.

The Threat Report, now in its seventh year, also found a sharp rise in data theft via DNS, with 26% of organizations reporting sensitive customer information stolen compared to 16% in 2020’s Threat Report. 

Evidence shows attackers are targeting more organizations and diversifying their toolkit—sometimes drastically. Threat actors relied on domain hijacking, where the user is connected not to the desired service but to a fake one, more than twice as often as last year. This year phishing also continued to grow in popularity (49% of companies experienced phishing attempts), as did malware-based attacks (38%), and traditional DDoS attacks (29%). 

Although the cost and variety of attacks remains high, there is a growing awareness of DNS security and how to combat these attacks.

76% of respondents in the 2021 Threat Report deemed DNS security a critical component of their network architecture. Additionally, the report found Zero Trust is evolving as a tool to protect networks in the remote era. 75% of companies are planning, implementing or running Zero Trust initiatives and 43% of companies believe DNS domain deny and allow lists are highly valuable for Zero Trust for improving control over access to apps. 

The DNS Threat Report finds solutions considered most effective by organizations for preventing theft includes: securing network endpoints (31%) and better monitoring threat and analysis of DNS traffic (26%).

“While it is positive that companies want to use DNS to protect their increasingly remote workforces, organizations are continuing to suffer the costly impacts of DNS attacks,” says Romain Fouchereau, Research Manager European Security at IDC. “As threat actors seek to diversify their toolkits, businesses must continue to be aware of the variety of threats posed, ensuring DNS security is a key priority to preventing these.”

DNS offers valuable information against would-be cybercriminals that is currently underutilized. According to results from the 2021 Threat Report, 25% of companies perform no analytics on their DNS traffic.

“This past year of the pandemic has shown us that DNS must play a role in an effective security system.” says Ronan David, VP of Strategy for EfficientIP.  “As workers look to more permanently transition to off-premise sites, making use of cloud, IoT, edge and 5G, companies and telecom providers should look to DNS for a proactive security strategy. This will ensure the prevention of network or application downtime as well as protecting organizations from confidential data theft and financial losses.”

The report suggests three recommendations for protecting data, apps, cloud services and users, including enhancing the privacy of remote workers with a private DoH solution, eliminating cloud service downtime caused by cloud misconfigurations through automating life-cycle management of IP resource and making DNS the first line of defense to stop the spread of attacks.