Best Practice Detail

13-13-8118

Network Operators, Service Providers, Public Safety and Government should provide DNS DDoS protection by implementing protection techniques such as: 1) Rate limiting DNS network connections 2) Provide robust DNS capacity in excess of maximum network connection traffic 3) Have traffic anomaly detection and response capability 4) Provide secondary DNS for back-up 5) Deploy Intrusion Prevention System in front of DNS to provide near real time alerts of a cyber-attack to provide near real time alerts of a cyber-attack. 6) Use cloud technologies to enable rapid instantiation of alternate networks and DNS capabilities. This BP applies to Public Safety only in an NG9-1-1 environment.

Status: Edited

References/Comments: RFC-2870, ISO/IEC 15408, ISO 17799,US-CERT \\\"Securing an Internet Name Server\\\" (http://www.cert.org/archive/pdf/dns.pdf).

Historical events:

• Network Operators
• Service Providers
• Public Safety
• Government
• Cable
• Internet/Data
• Satellite
• Wireless
• Wireline
• Cyber Security
• Disaster Recovery
• Emergency Preparedness
• Public Safety Service
• Intrusion Detection
• CSRIC VII: Edited By WG 4 In CSRIC VII