FOSE 2011: DNSSEC and the Government, Lessons Learned
•
0 likes•482 views
At FOSE 2011, the panel discussion on the deployment of domain name system security extensions (DNSSEC) within government included Neustar VP and Senior Technologist, Rodney Joffe, who sat side-by-side with some of the industry’s best and discussed how federal IT managers can leverage private sector best practices to meet OMB and FISMA mandated DNSSEC requirements. Entitled “DNS-3: Private Sector Deployment in .com, .net, .org and Beyond,” the panel discussed lessons learned and how federal agencies that have yet to deploy DNSSEC can do so successfully. Visit http://www.ultradns.com for more information.
Recommended
Recommended
More Related Content
What's hot
What's hot (14)
Viewers also liked
Similar to FOSE 2011: DNSSEC and the Government, Lessons Learned
Similar to FOSE 2011: DNSSEC and the Government, Lessons Learned (20)
More from Neustar, Inc.
More from Neustar, Inc. (11)
Recently uploaded
Recently uploaded (20)
FOSE 2011: DNSSEC and the Government, Lessons Learned
- 1. DNSSEC Deployment Lessons Learned Rodney Joffe SVP and Senior Technologist 07/20/2011
- 2. Neustar DNSSEC: Three Key Areas of Experience » 1) Signed TLD zones for registries we operate - .us, .biz, .co » 2) Hosted (secondary) signed ccTLDs – .uk, .jp, .fi, .nu » 3) Implemented a managed DNSSEC service using a code base entirely separate from BIND © Neustar Inc. / Proprietary and Confidential 2
- 3. Neustar Experience Signing TLD Zones » Our three signed zones have 1-2 million names each » We use NSEC negative answers and different DNSSEC key algorithms » We used a fairly straightforward deployment plan which requires care but is not scary © Neustar Inc. / Proprietary and Confidential 3
- 4. Neustar Experience: Hosting other signed TLDs » We have seen the impact of transferring signed zones » Different registries have used different approaches to DNSSEC which has an impact on zone distribution » Zones are larger » Zones are changed more often » Coordinating computing resources to handle the increased pressure of the updates was harder than anticipated © Neustar Inc. / Proprietary and Confidential 4
- 5. Neustar Experience: Managed DNSSEC Implementation » Neustar has nearly 10 years of experience in DNSSEC development and operations » US and BIZ registries are DNSSEC signed, 7 years after our first test beds » Participation in specification development » Active participation in global network operations fora » Other credentials relating to DNS » Pioneered anycast techniques » DDoS mitigation work » Experience in secure distributed database operations and operating Managed DNS services » Neustar’s fully managed DNS and DNSSEC solution provides: » Resiliency and reliability thanks to a multi node footprint » Automated, customizable key management » Optional FIPS Level 3 © Neustar Inc. / Proprietary and Confidential 5
- 6. Lessons Learned from Neustar Registry Deployment » Upfront effort to begin DNSSEC » Upgrade (renovate) DNS infrastructure to support DNSSEC » Institute key management functions. DNSSEC relies on solid key management » Creating a key poorly may lead to someone guessing it » Allowing keys to be seen by operators risks the secret » Choice of algorithms and key size » Timing of key operations, Signature lifetime, Key effectivity, and Key supersession » Ongoing effort to maintain DNSSEC » Keep data "fresh", DNSSEC data can go stale » Participation in more public meetings and mail lists © Neustar Inc. / Proprietary and Confidential 6
- 7. Thank You! © Neustar Inc. / Proprietary and Confidential 7
- 8. DNSSEC Chain of Trust Root DNS Authoritative DNS .com. .gov. .biz. (TLD) Authoritative DNS domain.biz site.biz. ultradns.biz (SLD) Recursive DNS Client / stub resolver