Podcast
Root Causes 375: What Is Name Space Lifecycle Management?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
April 5, 2024
In this guest episode we discuss name space hygiene with Geir Rasmussen, founder of NodeZro. CNAMEs, SPF, DMARC, name server entries, and other DNS identifiers, left unattended, can expose companies to identity-based attacks. We lay out the steps in addressing name space cleanup.
Podcast Transcript
Lightly edited for flow and brevity.
And through this journey, it occurred to me that domain names at the primary level, let's say, a google.com, again, are very well managed. There is a good supply chain there. There's lots of great brand protection registrars that help you look after these brands, making sure they renew every year, making sure you protect them. But when it comes to internal in organizations, there is very few companies and organizations that we have come across that have any processes or policies in place for managing their subdomains and that is where the underlying issue occurs. It's a lifecycle management and an asset management issue, much more so than a technical issue.
So first, try and get visibility on what you actually have and then you need to try and figure out how you instill some lifecycle management in your name space. And that is complicated. We work for organizations which have hundreds of thousands of these identifiers and fortunately and unfortunately, the DNS is a little bit too good at what it does. So, it doesn't have to be a domain name which no longer works anymore. We quite often see domain names that have name servers. I'll give you an example where the name servers should have ended in .net but they have forgot to put in the t and now the name server sits in a domain name in the share and that may be available for registration. So everything works fine. No one's seen this for years until someone comes along and goes, hang on a minute, I am gonna take that name server, and then I control your identity. Because these identifiers, they're like your digital passport because they are the ones you use to authenticate your company.
When you issue certificates, the concept of domain validated certificates is used all the time. If I control the domain name, I can, with most suppliers get a certificate, but I can also, I can also authenticate to Google that I control that domain name and set up Gmail or whatever else it is, and the same to many other companies. So that's the underlying issue.
So one of the companies we’re looking at may have 3,000, 4,000 primary domains. Google.com would be a primary domain. And then inside of each of those primary domains, they may have – it’s a very technical term, but in the DNS, it's called a zone, or sometimes a delegation. And each of these primary domains may have 200 or 300 of these delegations, and quite often each of those delegations or - - basically, a delegation is handing control to someone. And each of those quite often have different teams managing them. So trying to figure out who runs what, where is a very complex process. And we quite often see companies come and say, well, we'll do this ourselves. We’ll try and figure out who runs what and then four weeks later, they come back, and we have no idea who runs this. The person we have on record left five years ago. So that is the that is the challenge.
First, you need to map this out and you need to find out who is actually in control of these different zones or areas of control within your organization. And then you can start remediating maybe some of the more critical issues where your brand is at risk. And you can imagine, if you can take control of the brand of a major organization, that is a problem because that can be used to attack not only the organization but also the stakeholders of the organization.
So first of all, get that visibility. And then second, you need to find the individuals or teams that are in charge or in control and then that is - - the lack of tools. We don't have the tools to do so. And we're trying to do something about that but that is the toolset that is required to solve this issue.
Obviously, we only classify that as a medium risk but that should illustrate what a critical risk is. So this is very, very common. And that's an issue. And again, lifecycle management. That's the problem.
So ask yourself, do I have a list of all the subdomains that I have in my brands? And do I know who manages them? And I think the answer that nearly every organization will have to that is unfortunately, no.
So what we try to do is to give you a workflow for where you should start. Maybe you don't need to deal with 100,000 issues. There may be 100, or 200, which puts your organization at critical, real critical risks. If you deal with those, you have really taken away a big chunk of your overall exposure.
So there are ways of doing this piecemeal, but ultimately, the fundamental fix to this, all of these cybersecurity issues, and where your brand may point to content, which is not authorized, etc., those are symptoms, the fundamental, those are all symptoms of lack of lifecycle management. So, figuring out what is my process to get to a place where I have lifecycle management around these things, that is the ultimate underlying outcome that you want.
The other thing is, I think it's important that there's a very solid mature industry out there of what is often called corporate registrar, so brand protection registrars, that look after the primary domains, and we come across companies all the time who think they're protected by their supply chain, but there really isn't, and it's not like your supply chain has sold them something. That is not the case. It's just there's a lack of understanding. You may have gone through a corporate registrar and they may go, oh, well, we'll look after your domain names for you and then we will register them, make sure they're renewed every year and if someone infringes on your brand will take down that content, blah, blah, blah, all of these things. But sometimes that message ends up being someone's looking after all our domain names. So there's a disconnect between what people think they're buying and what they're actually buying.
The other thing is that we're seeing when it comes to traditional cybersecurity, there's a lot of great companies doing attack surface management, and they do service things like dangling, CNAMEs and cloud assets that can be compromised, etc. but it's looked at from a pure cybersecurity angle. These are vulnerabilities that your techies need to deal with. No one's really looking at, well, all of these things are nice, but they're all symptoms. What you actually have to do to secure yourself for the long term is a boring management process. It's very different. It's not some sexy cybersecurity thing. So that is, I think there's a messaging issue here where we need to talk about these things for what they actually are and they're pure old boring asset management.
The other thing we're seeing is that there is a difference from geography to geography, with some countries having less of these issues than others. Interestingly enough, that also seemed to be tied to digital transformation.

