DNSSEC

Image via Wikipedia

DNSSEC stands for DNS Security Extensions, and is designed to add security to the Domain Name System. As of May 5th, the last root server went through a a transitional milestone in the deployment of this protocol across the root DNS servers. As a resultall root servers are now serving up longer responses for DNSSEC requests. Full implementation of this new and major upgrade to the security of DNS at the root server level is expected to be finished by Mid-July. This will protect the DNS function from certain attacks, and all major DNS systems will be required to provide full or partial DNSSEC functionality within the next few years.
Specific functions that take place between a multi-campus company, or business transactions that use HTTPS(SSL), can now provide more security and integrity to transactions that take place using DNSSEC. It can provide for better origin authentication, data integrity, and authenticated denial of existence. One of the easy transition methods is the deployment of a DNSSEC appliance, which serves as a DNS signer for DNS zones. This can be a large, several thousand dollar appliance; or as inexpensive as a several hundred dollar, more portable device like a card or USB token.

In addition to accelerating DNSSEC compliance, These devices, known as Hardware Security Modules (HSM) provide support for other applications as well.

The applications are many, but are commonly deployed for such things as
1> Card Payment Systems
2> PKI Environments
3> Automated Teller Machines
4> POS Terminals

For these and other types of systems, the HSM provides an aid to securely encrypting data in a relatively unsecure database, verifying the integrity of the data in a database, and aids in verifying digital signatures.
The HSM provides FIPS 140-1 and 140-2 validation, and uses widely accepted algorithms for the most part. It is much more preferable to find a system that does not use a proprietary algorithm, so that the HSM can provide proven functionality for all necessary functions.

This is just one of many types of systems that can aid in an overall security solution. Providing that proper security processes, such as risk analysis, testing and careful administration of the device can ensure a better security posture for mid-sized businesses or greater integrity for financial transactions.

Related articles by Zemanta

• More network firms join VeriSign's DNSSec initiative (v3.co.uk)
• DNSSEC Adds Security to URLs (readwriteweb.com)