By Nivaldo Cleto* | Bali, Indonesia*
Internet security returned to the forefront of ICANN87[i] iscussions on Tuesday in Bali. Technical presentations by the Security and Stability Advisory Committee, SSAC[ii], focused on problems that often go unnoticed by users but can undermine trust in the addresses and services they use every day.
The organization’s recap brought together highlights from two Lightning Talk sessions, the second held on 20 October. Topics included measuring abuse, the risk of subdomain takeovers, digital certificate validation and the development of tools to protect the Internet’s naming system.
Forgotten records can open doors to criminals
One warning concerned so-called dangling DNS[iii] ecords: references that remain configured after the service they pointed to has ceased to exist.
In certain circumstances, this configuration can allow third parties to take control of a subdomain. To visitors, the address may still appear to belong to the original organization, even though someone else controls its content.
The issue illustrates how security also depends on maintaining services properly: retiring a tool requires reviewing the references that remain associated with it.
Measuring abuse and tracking responses
The NetBeacon Institute presented an update on its work measuring the malicious use of domain names and the rates at which that abuse is mitigated.
This monitoring helps explain both the scale of the problem and the responses adopted to address it. For businesses and users, there is a practical implication: identifying threats must be accompanied by measures capable of reducing their impact.
Digital certificates and DNS protection
Another presentation examined the complexities of the procedures Certificate Authorities use to verify control of a domain before issuing digital certificates.
This discussion concerns the security of Internet services and should not be confused with the specific procedures of Brazil’s ICP-Brasil public key infrastructure.
An updated timeline of DNSSEC[iv]Â signing across top-level domains was also presented. This technology allows the authenticity of DNS responses to be verified, helping protect users against their alteration.
The presentations highlighted technical challenges and security experience, without announcing newly approved rules. For those who use the Internet for work or business, one observation stands out: digital trust requires continuous attention, including to the infrastructure details we do not normally see.
Nivaldo Cleto represents business Internet users on the Brazilian Internet Steering Committee (CGI.br) and is a member of the ICANN Business Constituency.
Notes
[i] ICANN: Internet Corporation for Assigned Names and Numbers, the organization that coordinates the Internet’s unique identifiers, including the domain name system.
[ii] SSAC: ICANN’s Security and Stability Advisory Committee.
[iii] DNS: Domain Name System, which links names to the technical addresses used by Internet services.
[iv] DNSSEC: Domain Name System Security Extensions, which enable verification of the authenticity and integrity of DNS responses.
