{"id":2584,"date":"2025-10-07T12:55:27","date_gmt":"2025-10-07T10:55:27","guid":{"rendered":"https:\/\/www.sycope.com\/post\/dns-errors-and-dns-security-dnssec-protection-against-dns-attacks-and-dns-management-errors"},"modified":"2025-10-20T09:47:53","modified_gmt":"2025-10-20T07:47:53","slug":"bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors","status":"publish","type":"post","link":"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors","title":{"rendered":"B\u0142\u0119dy DNS i bezpiecze\u0144stwo DNS \u2013 DNSSEC, ochrona przed atakami DNS i DNS management errors"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Dlaczego_DNS_jest_krytyczny_dla_dostepnosci_i_bezpieczenstwa\" >Dlaczego DNS jest krytyczny dla dost\u0119pno\u015bci i bezpiecze\u0144stwa\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Najczestsze_bledy_DNS_i_DNS_management_errors_w_konfiguracji_i_zarzadzaniu_strefami\" >Najcz\u0119stsze b\u0142\u0119dy DNS i DNS management errors w konfiguracji i zarz\u0105dzaniu strefami\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Skutki_operacyjne_i_biznesowe_zlej_konfiguracji_DNS\" >Skutki operacyjne i biznesowe z\u0142ej konfiguracji DNS\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Typowe_wektory_atakow_DNS_i_jak_je_rozpoznac_%E2%80%94_praktyczny_przewodnik_%E2%80%9Eco_robic_gdy_to_sie_dzieje%E2%80%9D\" >Typowe wektory atak\u00f3w DNS i jak je rozpozna\u0107 \u2014 praktyczny przewodnik \u201eco robi\u0107, gdy to si\u0119 dzieje\u201d\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Runbook_detekcja_i_reakcja_na_anomalie_w_logach_DNS\" >Runbook: detekcja i reakcja na anomalie w logach DNS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#DNSSEC_w_praktyce_%E2%80%94_jak_wdrozyc_zaufanie_kryptograficzne_i_nie_zablokowac_wlasnych_uslug\" >DNSSEC w praktyce \u2014 jak wdro\u017cy\u0107 zaufanie kryptograficzne i nie zablokowa\u0107 w\u0142asnych us\u0142ug\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Dobre_praktyki_TTL_rekursja_autorytatywnosc_transfery_stref_i_split-horizon\" >Dobre praktyki: TTL, rekursja, autorytatywno\u015b\u0107, transfery stref i split-horizon\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Monitoring_i_reagowanie_logi_telemetria_alerty_i_testy_integralnosci_bezpieczenstwa_DNS\" >Monitoring i reagowanie: logi, telemetria, alerty i testy integralno\u015bci bezpiecze\u0144stwa DNS\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.sycope.com\/pl\/post\/bledy-dns-i-bezpieczenstwo-dns-dnssec-ochrona-przed-atakami-dns-i-dns-managemen-errors\/#Plan_naprawczy_i_audyt_ciagly_jak_nie_wpasc_drugi_raz_w_te_same_bledy_DNS\" >Plan naprawczy i audyt ci\u0105g\u0142y: jak nie wpa\u015b\u0107 drugi raz w te same b\u0142\u0119dy DNS\u00a0<\/a><\/li><\/ul><\/nav><\/div>\n<h2 data-start=\"0\" data-end=\"51\"><span class=\"ez-toc-section\" id=\"Dlaczego_DNS_jest_krytyczny_dla_dostepnosci_i_bezpieczenstwa\"><\/span><span class=\"TextRun SCXW239909276 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW239909276 BCX0\" data-ccp-parastyle=\"Heading 2\">Dlaczego DNS jest krytyczny dla dost\u0119pno\u015bci i<\/span> <span class=\"NormalTextRun SCXW239909276 BCX0\" data-ccp-parastyle=\"Heading 2\">bezpiecze\u0144stw<\/span><span class=\"NormalTextRun SCXW239909276 BCX0\" data-ccp-parastyle=\"Heading 2\">a<\/span><\/span><span class=\"EOP SCXW239909276 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">System nazw domenowych (<\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\">) to kr\u0119gos\u0142up Internetu. Ka\u017cde po\u0142\u0105czenie u\u017cytkownika z aplikacj\u0105, serwisem czy us\u0142ug\u0105 w chmurze zaczyna si\u0119 od przet\u0142umaczenia przyjaznej dla cz\u0142owieka nazwy domenowej na adres IP. Bez tego procesu ca\u0142a komunikacja oparta na domenach stan\u0119\u0142aby w miejscu. To sprawia, \u017ce <\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> jest jednocze\u015bnie <\/span><b><span data-contrast=\"auto\">punktem krytycznym dla dost\u0119pno\u015bci<\/span><\/b><span data-contrast=\"auto\"> i <\/span><b><span data-contrast=\"auto\">wektorem ryzyka w bezpiecze\u0144stwie<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">DNS jako fundament dzia\u0142ania us\u0142ug<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Rozwi\u0105zywanie nazw<\/span><\/b><span data-contrast=\"auto\">: aplikacje i u\u017cytkownicy rzadko operuj\u0105 adresami IP \u2013 <\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> pozwala na wygodne mapowanie domen na adresy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">\u0141a\u0144cuch zale\u017cno\u015bci<\/span><\/b><span data-contrast=\"auto\">: resolver rekursyjny \u2192 serwery root \u2192 TLD \u2192 serwer autorytatywny \u2192 odpowied\u017a do klienta. Ka\u017cdy z element\u00f3w musi dzia\u0142a\u0107 poprawnie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Wydajno\u015b\u0107<\/span><\/b><span data-contrast=\"auto\">: op\u00f3\u017anienia w <\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> bezpo\u015brednio przek\u0142adaj\u0105 si\u0119 na czas \u0142adowania stron i responsywno\u015b\u0107 aplikacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Skutki pojedynczego punktu awarii<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Brak redundancji w infrastrukturze <\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> mo\u017ce sprawi\u0107, \u017ce nawet niewielka awaria odetnie u\u017cytkownik\u00f3w od us\u0142ug.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Sytuacja<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Skutek techniczny<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Skutek biznesowy<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Awaria jedynego serwera nazw<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Brak odpowiedzi, b\u0142\u0119dy SERVFAIL<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Niedost\u0119pno\u015b\u0107 aplikacji<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">B\u0142\u0119dne glue records<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Resolver nie znajdzie serwera autorytatywnego<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Utrata transakcji online<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Przeci\u0105\u017cony resolver rekursyjny<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wysokie op\u00f3\u017anienia odpowiedzi<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Spadek jako\u015bci us\u0142ug (QoE)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>&nbsp;<\/p>\n<h3><b><span data-contrast=\"none\">DNS w kontek\u015bcie bezpiecze\u0144stwa<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> bywa niedoceniany jako element obrony. W praktyce:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Kompromitacja DNS<\/span><\/b><span data-contrast=\"auto\"> pozwala atakuj\u0105cemu przej\u0105\u0107 kontrol\u0119 nad ruchem i skierowa\u0107 go na w\u0142asne serwery.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Ataki DNS<\/span><\/b><span data-contrast=\"auto\"> cz\u0119sto omijaj\u0105 inne warstwy zabezpiecze\u0144 (firewalle, WAF), poniewa\u017c dziej\u0105 si\u0119 przed nawi\u0105zaniem w\u0142a\u015bciwego po\u0142\u0105czenia.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">B\u0142\u0119dna konfiguracja DNS<\/span><\/b><span data-contrast=\"auto\"> otwiera drog\u0119 do phishingu, podszywania si\u0119 pod us\u0142ugi i manipulacji odpowiedziami.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">DNS a SLA i ci\u0105g\u0142o\u015b\u0107 dzia\u0142ania<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Dla system\u00f3w krytycznych, takich jak bankowo\u015b\u0107 online, platformy e-commerce czy SaaS, poprawno\u015b\u0107 dzia\u0142ania <\/span><b><span data-contrast=\"auto\">DNS<\/span><\/b><span data-contrast=\"auto\"> wp\u0142ywa bezpo\u015brednio na:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">SLA<\/span><\/b><span data-contrast=\"auto\"> (Service Level Agreement) \u2013 czas dost\u0119pno\u015bci us\u0142ug.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">RTO i RPO<\/span><\/b><span data-contrast=\"auto\"> \u2013 czas przywracania i punkt odtworzenia po awarii.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Zgodno\u015b\u0107 regulacyjn\u0105<\/span><\/b><span data-contrast=\"auto\"> \u2013 np. wymogi w sektorze finansowym i telekomunikacyjnym.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">DNS <\/span><\/b><span data-contrast=\"auto\">to nie tylko techniczne t\u0142umaczenie nazw, ale <\/span><b><span data-contrast=\"auto\">fundamentalna us\u0142uga infrastrukturalna<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3ra \u0142\u0105czy dost\u0119pno\u015b\u0107 i <\/span><b><span data-contrast=\"auto\">bezpiecze\u0144stwo<\/span><\/b><span data-contrast=\"auto\">. Ka\u017cdy b\u0142\u0105d czy luk\u0119 w tej warstwie trzeba traktowa\u0107 jak realne zagro\u017cenie dla ca\u0142ej organizacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Najczestsze_bledy_DNS_i_DNS_management_errors_w_konfiguracji_i_zarzadzaniu_strefami\"><\/span><b><span data-contrast=\"none\">Najcz\u0119stsze b\u0142\u0119dy DNS i DNS management errors w konfiguracji i zarz\u0105dzaniu strefami<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">B\u0142\u0119dna konfiguracja serwer\u00f3w nazw to jeden z g\u0142\u00f3wnych powod\u00f3w niedost\u0119pno\u015bci us\u0142ug i podatno\u015bci na ataki. Wiele problem\u00f3w wynika z pozornie drobnych zaniedba\u0144, kt\u00f3re w praktyce staj\u0105 si\u0119 krytycznymi lukami.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Typowe problemy spotykane w \u015brodowiskach produkcyjnych<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Brak redundancji i dywersyfikacji<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Jeden serwer NS lub brak geograficznego rozproszenia prowadzi do sytuacji, w kt\u00f3rej awaria odcina u\u017cytkownik\u00f3w od us\u0142ug.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Lame delegations i b\u0142\u0119dne glue records<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Je\u015bli delegacja wskazuje na serwer, kt\u00f3ry nie jest autorytatywny dla danej strefy albo glue record jest niepoprawny, resolvery nie s\u0105 w stanie znale\u017a\u0107 w\u0142a\u015bciwego \u017ar\u00f3d\u0142a.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Niepoprawne parametry SOA<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Zbyt d\u0142ugi lub zbyt kr\u00f3tki refresh, b\u0142\u0119dny serial czy brak sp\u00f3jno\u015bci mi\u0119dzy serwerami mog\u0105 prowadzi\u0107 do niezsynchronizowanych danych i rozbie\u017cnych odpowiedzi.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Niew\u0142a\u015bciwe warto\u015bci TTL<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Skrajnie niskie TTL powoduj\u0105 nadmierne obci\u0105\u017cenie resolver\u00f3w, a zbyt wysokie utrudniaj\u0105 szybkie propagowanie zmian.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Problematyczne CNAME<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Stosowanie rekord\u00f3w CNAME w apex strefy lub tworzenie \u0142a\u0144cuch\u00f3w odwo\u0142a\u0144 generuje op\u00f3\u017anienia i ryzyko b\u0142\u0119d\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Otwarte transfery stref (AXFR)<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Brak kontroli dost\u0119pu do transfer\u00f3w stref umo\u017cliwia atakuj\u0105cym przej\u0119cie pe\u0142nej listy rekord\u00f3w i analiz\u0119 struktury systemu.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"7\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Rekursja na serwerach autorytatywnych<\/span><\/b><br \/>\n<span data-contrast=\"auto\">To klasyczny <\/span><b><span data-contrast=\"auto\">b\u0142\u0105d DNS<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3ry wystawia infrastruktur\u0119 na ataki amplifikacyjne i nadu\u017cycia.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"8\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Problemy z obs\u0142ug\u0105 IPv6<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Brak rekord\u00f3w AAAA, niesp\u00f3jne delegacje odwrotne czy brak PTR skutkuj\u0105 obni\u017ceniem zaufania np. do serwer\u00f3w pocztowych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"9\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Fragmentacja odpowiedzi EDNS<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Zbyt du\u017ce odpowiedzi, brak obs\u0142ugi TCP i nieprawid\u0142owe ustawienia EDNS mog\u0105 prowadzi\u0107 do utraty pakiet\u00f3w i trudnych w diagnozie awarii.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"10\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Rekordy osierocone<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Pozostawione po migracjach subdomeny, wskazuj\u0105ce na nieistniej\u0105ce zasoby, mog\u0105 zosta\u0107 przej\u0119te przez atakuj\u0105cych (<\/span><b><span data-contrast=\"auto\">subdomain takeover<\/span><\/b><span data-contrast=\"auto\">).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"11\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">S\u0142abe procesy zarz\u0105dzania<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Brak kontroli dost\u0119pu do paneli rejestratora, s\u0142abe has\u0142a, brak blokady domeny na poziomie rejestratora \u2013 to klasyczne <\/span><b><span data-contrast=\"auto\">DNS management errors<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3re prowadz\u0105 do przej\u0119cia domeny.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Specyficzne b\u0142\u0119dy zwi\u0105zane z DNSSEC<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Brak rekordu DS u rodzica \u2013 brak pe\u0142nej \u015bcie\u017cki zaufania.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Niezsynchronizowane podpisy RRSIG lub wygas\u0142e rekordy \u2013 u\u017cytkownicy otrzymuj\u0105 b\u0142\u0119dy SERVFAIL.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Nieudane rotacje kluczy (KSK\/ZSK) \u2013 strefa zostaje niepodpisana lub nieweryfikowalna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Split-horizon bez w\u0142a\u015bciwej kontroli<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">\u0179le skonfigurowany split-horizon prowadzi do wycieku prywatnych rekord\u00f3w lub konflikt\u00f3w mi\u0119dzy strefami publicznymi i wewn\u0119trznymi.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Najcz\u0119stsze <\/span><b><span data-contrast=\"auto\">b\u0142\u0119dy DNS <\/span><\/b><span data-contrast=\"auto\">wynikaj\u0105 nie tyle z braku technologii, co z zaniedba\u0144 operacyjnych i braku dobrych proces\u00f3w. Dlatego kluczowe jest regularne audytowanie konfiguracji i automatyzacja zarz\u0105dzania strefami.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Skutki_operacyjne_i_biznesowe_zlej_konfiguracji_DNS\"><\/span><b><span data-contrast=\"none\">Skutki operacyjne i biznesowe z\u0142ej konfiguracji DNS<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">B\u0142\u0119dna konfiguracja serwer\u00f3w nazw czy delegacji to nie tylko problem techniczny. Ka\u017cdy <\/span><b><span data-contrast=\"auto\">b\u0142\u0105d DNS <\/span><\/b><span data-contrast=\"auto\">mo\u017ce wywo\u0142a\u0107 konsekwencje, kt\u00f3re organizacja odczuje finansowo i wizerunkowo.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Najbardziej oczywistym skutkiem jest <\/span><b><span data-contrast=\"auto\">niedost\u0119pno\u015b\u0107 us\u0142ug<\/span><\/b><span data-contrast=\"auto\">. Wystarczy niepoprawny glue record, brak redundancji serwer\u00f3w czy wyga\u015bni\u0119cie podpis\u00f3w w DNSSEC, by u\u017cytkownicy zobaczyli komunikaty SERVFAIL albo NXDOMAIN zamiast strony internetowej. Z perspektywy biznesowej oznacza to bezpo\u015bredni\u0105 utrat\u0119 przychod\u00f3w i z\u0142amanie SLA.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Drugim, cz\u0119sto niedocenianym obszarem jest <\/span><b><span data-contrast=\"auto\">zaufanie klient\u00f3w<\/span><\/b><span data-contrast=\"auto\">. Gdy subdomena zostaje przej\u0119ta lub rekordy wskazuj\u0105 w nieodpowiednie miejsce, u\u017cytkownicy zaczynaj\u0105 podejrzewa\u0107 phishing lub celowe wprowadzanie w b\u0142\u0105d. Odbudowanie reputacji marki po takich incydentach bywa trudniejsze i dro\u017csze ni\u017c sama naprawa techniczna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Problemy dotykaj\u0105 r\u00f3wnie\u017c system\u00f3w pocztowych. Niesp\u00f3jne rekordy MX, brak PTR czy b\u0142\u0119dnie ustawione SPF\/DKIM\/DMARC powoduj\u0105, \u017ce wiadomo\u015bci trafiaj\u0105 do spamu lub w og\u00f3le nie s\u0105 dostarczane. W efekcie firma traci mo\u017cliwo\u015b\u0107 komunikacji z klientami i partnerami, a w przypadku us\u0142ug transakcyjnych \u2014 ryzykuje utrat\u0119 kluczowych operacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Warto zwr\u00f3ci\u0107 uwag\u0119 na <\/span><b><span data-contrast=\"auto\">koszty operacyjne<\/span><\/b><span data-contrast=\"auto\">. Ka\u017cdy incydent wywo\u0142any przez <\/span><b><span data-contrast=\"auto\">DNS management errors<\/span><\/b><span data-contrast=\"auto\"> wymaga interwencji zespo\u0142\u00f3w IT. Gdy b\u0142\u0119dy s\u0105 cz\u0119ste, a procesy r\u0119czne, wsparcie techniczne poch\u0142ania coraz wi\u0119cej zasob\u00f3w. Co gorsza, przy braku sp\u00f3jnych log\u00f3w i monitoringu ustalenie przyczyn awarii zajmuje d\u0142ugie godziny, co zwi\u0119ksza straty i wyd\u0142u\u017ca czas odtworzenia us\u0142ug.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Nie wolno te\u017c zapomina\u0107 o <\/span><b><span data-contrast=\"auto\">ryzyku regulacyjnym<\/span><\/b><span data-contrast=\"auto\">. W bran\u017cach regulowanych, takich jak finanse czy telekomunikacja, przestoje i b\u0142\u0119dy w obs\u0142udze DNS mog\u0105 skutkowa\u0107 nie tylko niezadowoleniem klient\u00f3w, ale r\u00f3wnie\u017c karami nadzoru lub sankcjami wynikaj\u0105cymi z kontrakt\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Ka\u017cdy <\/span><b><span data-contrast=\"auto\">b\u0142\u0105d DNS<\/span><\/b><span data-contrast=\"auto\"> nale\u017cy postrzega\u0107 w kategoriach ryzyka biznesowego. Nie chodzi tylko o techniczn\u0105 poprawno\u015b\u0107, ale o stabilno\u015b\u0107 przychod\u00f3w, reputacj\u0119 marki i zgodno\u015b\u0107 z regulacjami. Dlatego <\/span><b><span data-contrast=\"auto\">bezpiecze\u0144stwo DNS<\/span><\/b><span data-contrast=\"auto\"> powinno by\u0107 integralnym elementem strategii ci\u0105g\u0142o\u015bci dzia\u0142ania.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Typowe_wektory_atakow_DNS_i_jak_je_rozpoznac_%E2%80%94_praktyczny_przewodnik_%E2%80%9Eco_robic_gdy_to_sie_dzieje%E2%80%9D\"><\/span><b><span data-contrast=\"none\">Typowe wektory atak\u00f3w DNS i jak je rozpozna\u0107 \u2014 praktyczny przewodnik \u201eco robi\u0107, gdy to si\u0119 dzieje\u201d<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">DNS jest miejscem, w kt\u00f3rym atakuj\u0105cy potrafi\u0105 uzyska\u0107 najwi\u0119kszy zwrot z nak\u0142adu \u2014 przej\u0119cie ruchu, eksfiltracja danych, lub generuj\u0105c SPAM. Poni\u017cej opisujemy najwa\u017cniejsze <\/span><b><span data-contrast=\"auto\">ataki DNS<\/span><\/b><span data-contrast=\"auto\">, jak je rozpozna\u0107 w telemetrii i jak natychmiast reagowa\u0107.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">1) Cache poisoning \/ manipulacja odpowiedziami<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> fa\u0142szywe odpowiedzi wpisywane do cache\u2019u resolvera, kt\u00f3re kieruj\u0105 klient\u00f3w na z\u0142o\u015bliwe adresy.<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> skok nag\u0142ych rekord\u00f3w A\/AAAA wskazuj\u0105cych na nowe, nieznane adresy IP; niespodziewana zmiana widoczna w pasywnym DNS; u\u017cytkownicy zg\u0142aszaj\u0105 przekierowania. W telemetrii: wzrost zapyta\u0144 do nietypowych adres\u00f3w autorytatywnych.<\/span><br \/>\n<b><span data-contrast=\"auto\">Szybka obrona:<\/span><\/b><span data-contrast=\"auto\"> walidacja DNSSEC na warstwie resolvera, monitorowanie pasywnego DNS, blokowanie podejrzanych IP w firewallu.<\/span><br \/>\n<b><span data-contrast=\"auto\">Uwaga:<\/span><\/b> <b><span data-contrast=\"auto\">DNSSEC <\/span><\/b><span data-contrast=\"auto\">znacznie utrudnia ten atak, ale jego b\u0142\u0119dna konfiguracja mo\u017ce spowodowa\u0107 masowy SERVFAIL.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><b><span data-contrast=\"none\">2) Rekrutacja i wykorzystanie otwartych resolver\u00f3w (amplifikacja, DDoS)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> atakuj\u0105cy wykorzystuje otwarte (rekursywne) serwery do wysy\u0142ania du\u017cej ilo\u015bci ruchu do ofiary (refleksja\/amplifikacja) korzystaj\u0105c z IP spoofing.<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> nag\u0142y wzrost QPS z wielu \u017ar\u00f3de\u0142; du\u017cy udzia\u0142 UDP (a tak\u017ce TCP w przypadku truncation); wysoka liczba odpowiedzi z du\u017cym rozmiarem (EDNS). W logach: du\u017co zapyta\u0144 typu ANY lub rekord\u00f3w powoduj\u0105cych du\u017ce odpowiedzi.<\/span><br \/>\n<b><span data-contrast=\"auto\">Szybka obrona:<\/span><\/b><span data-contrast=\"auto\"> wy\u0142\u0105czy\u0107 rekursj\u0119 na autorytatywnych; w resolverach: RRL (response-rate limiting), filtrowanie \u017ar\u00f3de\u0142, rate-limiting na kraw\u0119dzi sieci, anycast dla autorytatywnych.<\/span><br \/>\n<b><span data-contrast=\"auto\">D\u0142ugoterminowo:<\/span><\/b><span data-contrast=\"auto\"> zamkn\u0105\u0107 otwarte resolvery, stosowa\u0107 ACL i TSIG dla transfer\u00f3w stref.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">3) Subdomain takeover (przej\u0119cie subdomeny)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> osierocone rekordy wskazuj\u0105 na zas\u00f3b w zewn\u0119trznej us\u0142udze (S3, Heroku, Azure); po usuni\u0119ciu oryginalnego zasobu atakuj\u0105cy mo\u017ce zarejestrowa\u0107 wolny endpoint.<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> rekordy A\/CNAME wskazuj\u0105ce na nieaktywny lub wygas\u0142y hosting; wzrost NXDOMAIN na subdomenach; nag\u0142e pojawienie si\u0119 nowych certyfikat\u00f3w dla danego subdomeny w publicznych repo.<\/span><br \/>\n<b><span data-contrast=\"auto\">Szybka obrona:<\/span><\/b><span data-contrast=\"auto\"> audit rekord\u00f3w, usuni\u0119cie nieu\u017cywanych wpis\u00f3w, stosowanie kr\u00f3tkiego TTL przed migracj\u0105, monitoring zmian w pasywnym DNS i certyfikatach.<\/span><br \/>\n<b><span data-contrast=\"auto\">Proces naprawczy:<\/span><\/b><span data-contrast=\"auto\"> natychmiast edytuj\/usu\u0144 osierocone rekordy, zablokuj mo\u017cliwo\u015b\u0107 tworzenia wildcard\u00f3w bez kontroli.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">4) DNS tunneling (eksfiltracja danych przez DNS)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> ukrywanie danych w polach zapyta\u0144\/replies (TXT, long labels) \u2014 kana\u0142 C2 lub exfiltracja.<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> wiele zapyta\u0144 z d\u0142ugimi etykietami o wysokiej entropii; nietypowe wzorce TXT\/NULL; specyficzne interwa\u0142y zapyta\u0144. W telemetrii: wzrost liczby unikalnych subdomen generowanych przez pojedyncze \u017ar\u00f3d\u0142o.<\/span><br \/>\n<b><span data-contrast=\"auto\">Szybka obrona:<\/span><\/b><span data-contrast=\"auto\"> analizowa\u0107 entropi\u0119 QNAME, blokowa\u0107 d\u0142ugie i nietypowe typy rekord\u00f3w, stosowa\u0107 DPI\/IDS z detekcj\u0105 tunelowania przez DNS.<\/span><br \/>\n<b><span data-contrast=\"auto\">D\u0142ugoterminowo:<\/span><\/b><span data-contrast=\"auto\"> blokada nietypowych typ\u00f3w rekord\u00f3w wychodz\u0105cych, restrykcyjne polityki rekurencji, rozdzielenie resolver\u00f3w wewn\u0119trznych od publicznych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">5) Hijacking domeny \/ atak na rejestratora<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> przej\u0119cie konta u rejestratora prowadzi do zmiany delegacji NS lub transferu domeny.<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> nag\u0142a zmiana NS w pasywnym DNS, nieautoryzowane zmiany DS, alert od rejestratora\/WHOIS o transferze.<\/span><br \/>\n<b><span data-contrast=\"auto\">Szybka obrona:<\/span><\/b><span data-contrast=\"auto\"> MFA i blokada transferu w rejestratorze, kontakt z rejestratorem, natychmiastowy rollback zmian DNS.<\/span><br \/>\n<b><span data-contrast=\"auto\">Proces zapobiegawczy:<\/span><\/b><span data-contrast=\"auto\"> polityki bezpiecze\u0144stwa kont rejestrator\u00f3w, zapisy kontakt\u00f3w eskalacyjnych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">6) Cache snooping i reconnaissance (wywiad przez DNS)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">Co to jest:<\/span><\/b><span data-contrast=\"auto\"> atakuj\u0105cy bada, jakie rekordy s\u0105 w cache resolver\u00f3w (np. po to, by znale\u017a\u0107 warto\u015bci sesji lub wewn\u0119trzne subdomeny).<\/span><br \/>\n<b><span data-contrast=\"auto\">Jak rozpozna\u0107:<\/span><\/b><span data-contrast=\"auto\"> seria zapyta\u0144 o ma\u0142o prawdopodobne, losowe nazwy, analizowane odpowiedzi; wzrost NXDOMAIN z nietypowych adres\u00f3w.<\/span><br \/>\n<b><span data-contrast=\"auto\">Obrona:<\/span><\/b><span data-contrast=\"auto\"> QNAME minimization, polityki response-minimization, ograniczenie szczeg\u00f3\u0142\u00f3w w odpowiedziach DNS.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Szybkie por\u00f3wnanie (Atak \u2192 Szybka detekcja \u2192 Pierwsze kroki)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Atak<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Szybka detekcja<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Natychmiastowe kroki<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Cache poisoning<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Niespodziewane IP dla wa\u017cnych rekord\u00f3w<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wymusi\u0107 od\u015bwie\u017cenie cache, w\u0142\u0105czy\u0107 walidacj\u0119 DNSSEC<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Amplifikacja DDoS<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Skok QPS, du\u017ce UDP, wysoki udzia\u0142 truncation<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">W\u0142\u0105czy\u0107 RRL, rate-limit, anycast, filtrowa\u0107 otwarte resolvery<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Subdomain takeover<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wzrost NXDOMAIN dla subdomen, brak hosta docelowego<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Usuni\u0119cie osieroconych rekord\u00f3w, skr\u00f3cenie TTL, monitor certyfikat\u00f3w<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">DNS tunneling<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wysoka entropia QNAME, wiele TXT\/NULL<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zablokowa\u0107 podejrzane typy, DPI, analizowa\u0107 patterny<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Rejestrator hijack<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zmiana NS\/DS w WHOIS\/pasywnym DNS<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Kontakt z rejestratorem, MFA, przywr\u00f3cenie delegacji<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/div>\n<h3><b><span data-contrast=\"none\">Kr\u00f3tki, praktyczny playbook incydentowy (6 krok\u00f3w \u2014 \u201eco zrobi\u0107 teraz\u201d)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Zidentyfikuj i zablokuj<\/span><\/b><span data-contrast=\"auto\"> \u2014 odetnij ruch do podejrzanych IP\/subdomen w zaporach i CDN.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Izoluj komponenty<\/span><\/b><span data-contrast=\"auto\"> \u2014 oddziel publiczne resolvery od wewn\u0119trznych; wy\u0142\u0105cz rekursj\u0119 tam, gdzie niepotrzebna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Weryfikuj podpisy i DS<\/span><\/b><span data-contrast=\"auto\"> \u2014 sprawd\u017a stan <\/span><b><span data-contrast=\"auto\">DNSSEC<\/span><\/b><span data-contrast=\"auto\"> i wa\u017cno\u015b\u0107 RRSIG.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Sprawd\u017a rejestratora<\/span><\/b><span data-contrast=\"auto\"> \u2014 upewnij si\u0119, \u017ce nie zasz\u0142y zmiany NS\/transfery.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Analiza telemetrii<\/span><\/b><span data-contrast=\"auto\"> \u2014 QPS, NXDOMAIN, SERVFAIL, TCP\/UDP ratio, QNAME entropy, liczba unikalnych subdomen.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Komunikacja<\/span><\/b><span data-contrast=\"auto\"> \u2014 powiadom zespo\u0142y aplikacyjne, wska\u017c status i kroki naprawcze; je\u015bli to potrzeba, komunikat do klient\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">DNSSEC <\/span><\/b><span data-contrast=\"auto\">zabezpiecza przed fundamentalnym rodzajem manipulacji (cache poisoning), ale jest jednocze\u015bnie narz\u0119dziem dwusiecznym: \u017ale wdro\u017cone mo\u017ce spowodowa\u0107 natychmiastow\u0105 niedost\u0119pno\u015b\u0107 us\u0142ugi. To pokazuje sedno problemu: <\/span><b><span data-contrast=\"auto\">bezpiecze\u0144stwo DNS<\/span><\/b><span data-contrast=\"auto\"> to nie tylko technologie; to procesy, monitoring i gotowo\u015b\u0107 do szybkiego reagowania.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Runbook_detekcja_i_reakcja_na_anomalie_w_logach_DNS\"><\/span><b><span data-contrast=\"none\">Runbook: detekcja i reakcja na anomalie w logach DNS<\/span><\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><b style=\"font-size: 16px;\"><span data-contrast=\"none\">Wzrost NXDOMAIN \u2013 potencjalny random subdomain attack lub tunneling<\/span><\/b><\/h3>\n<p><b><span data-contrast=\"auto\">Cel:<\/span><\/b><span data-contrast=\"auto\"> znale\u017a\u0107 hosty generuj\u0105ce masowo nieistniej\u0105ce nazwy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">BIND (querylog w\u0142\u0105czony):<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">grep NXDOMAIN \/var\/log\/named\/query.log | awk '{print $8}&#8217; | sort | uniq -c | sort -nr | head<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">dnstap (je\u015bli u\u017cywasz):<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">dnstap-read capture.dt | grep NXDOMAIN<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Co sprawdzi\u0107:<\/span><\/b><span data-contrast=\"auto\"> czy jeden klient generuje tysi\u0105ce unikalnych subdomen w kr\u00f3tkim czasie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybka reakcja:<\/span><\/b><span data-contrast=\"auto\"> blokada IP w firewallu lub w resolverze; weryfikacja, czy to nie fa\u0142szywie dodatni wynik (np. testy dev).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Analiza entropii QNAME \u2013 wskazuje na DNS tunneling<\/span><\/b><\/h3>\n<p><b><span data-contrast=\"auto\">Cel:<\/span><\/b><span data-contrast=\"auto\"> wykry\u0107 d\u0142ugie, losowe etykiety w zapytaniach.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Zeek (bro):<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">event dns_request(c: connection, msg: dns_msg, query: string)<\/span><br \/>\n<span data-contrast=\"auto\">\u00a0 {<\/span><br \/>\n<span data-contrast=\"auto\">\u00a0\u00a0\u00a0 if (|query| &gt; 50 &amp;&amp; entropy(query) &gt; 4.0)<\/span><br \/>\n<span data-contrast=\"auto\">\u00a0\u00a0\u00a0\u00a0\u00a0 print fmt(&#8222;POSSIBLE DNS TUNNELING: %s -&gt; %s&#8221;, c$id$orig_h, query);<\/span><br \/>\n<span data-contrast=\"auto\">\u00a0 }<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Logstash\/Elastic:<\/span><\/b><span data-contrast=\"auto\"> mo\u017cesz doda\u0107 pole \u201eentropy_score\u201d i tworzy\u0107 alerty na warto\u015bci &gt;4,5.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Co sprawdzi\u0107:<\/span><\/b><span data-contrast=\"auto\"> powtarzalne d\u0142ugie zapytania TXT, NULL lub nietypowych typ\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybka reakcja:<\/span><\/b><span data-contrast=\"auto\"> zablokuj rekordy na firewallu DNS (dnsdist\/unbound) albo zastosuj polityk\u0119 \u201edrop\u201d dla danej domeny.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Nag\u0142a zmiana delegacji \u2013 sygna\u0142 hijackingu domeny<\/span><\/b><\/h3>\n<p><b><span data-contrast=\"auto\">Cel:<\/span><\/b><span data-contrast=\"auto\"> monitorowa\u0107 rekordy NS\/DS dla w\u0142asnych domen.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">dig z cron (bash):<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">dig +short NS moja-domena.pl &gt;&gt; \/var\/log\/ns-check.log<\/span><br \/>\n<span data-contrast=\"auto\">dig +short DS moja-domena.pl &gt;&gt; \/var\/log\/ds-check.log<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Por\u00f3wnanie z poprzednimi warto\u015bciami (np. <\/span><span data-contrast=\"auto\">diff<\/span><span data-contrast=\"auto\">).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybka reakcja:<\/span><\/b><span data-contrast=\"auto\"> w przypadku niespodziewanej zmiany natychmiast kontakt z rejestratorem i wymuszenie rollbacku.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Wzrost zapyta\u0144 typu ANY \u2013 klasyczna amplifikacja<\/span><\/b><\/h3>\n<p><b><span data-contrast=\"auto\">Cel:<\/span><\/b><span data-contrast=\"auto\"> znale\u017a\u0107 \u017ar\u00f3d\u0142a nadu\u017cywaj\u0105ce resolvera.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">BIND query log:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">grep &#8222;ANY&#8221; \/var\/log\/named\/query.log | awk '{print $5}&#8217; | sort | uniq -c | sort -nr | head<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">dnstap + jq:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">dnstap-read capture.dt | jq 'select(.message.query_type == &#8222;ANY&#8221;)&#8217;<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybka reakcja:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"2\"><span data-contrast=\"auto\">w\u0142\u0105czy\u0107 <\/span><span data-contrast=\"auto\">minimal-responses yes;<\/span><span data-contrast=\"auto\"> w BIND,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"2\"><span data-contrast=\"auto\">skonfigurowa\u0107 Response Rate Limiting (RRL),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"2\"><span data-contrast=\"auto\">odci\u0105\u0107 adresy generuj\u0105ce najwi\u0119kszy wolumen.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Monitorowanie wygasania podpis\u00f3w DNSSEC<\/span><\/b><\/h3>\n<p><b><span data-contrast=\"auto\">Cel:<\/span><\/b><span data-contrast=\"auto\"> nie dopu\u015bci\u0107 do SERVFAIL z powodu wyga\u015bni\u0119cia RRSIG.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">ldns-dane-check:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">ldns-verify-zone moja-strefa.zone<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Nagios\/Prometheus exporter:<\/span><\/b><span data-contrast=\"auto\"> monitoruje daty wyga\u015bni\u0119cia RRSIG i zg\u0142asza alerty na &lt;48h.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybka reakcja:<\/span><\/b><span data-contrast=\"auto\"> wymusi\u0107 re-signing strefy, sprawdzi\u0107 DS u rodzica, potwierdzi\u0107, \u017ce propagacja przebieg\u0142a poprawnie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Wskaz\u00f3wka praktyczna: <\/span><\/b><span data-contrast=\"auto\">Dobrze mie\u0107 <\/span><i><span data-contrast=\"auto\">baseline<\/span><\/i><span data-contrast=\"auto\"> normalnego ruchu DNS (\u015brednia liczba NXDOMAIN, rozk\u0142ad typ\u00f3w rekord\u00f3w, \u015brednia entropia QNAME). Bez tego trudno stwierdzi\u0107, czy anomalia to atak, czy po prostu nietypowe zachowanie aplikacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC_w_praktyce_%E2%80%94_jak_wdrozyc_zaufanie_kryptograficzne_i_nie_zablokowac_wlasnych_uslug\"><\/span><b><span data-contrast=\"none\">DNSSEC w praktyce \u2014 jak wdro\u017cy\u0107 zaufanie kryptograficzne i nie zablokowa\u0107 w\u0142asnych us\u0142ug<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><b><span data-contrast=\"auto\">DNSSEC<\/span><\/b><span data-contrast=\"auto\"> ma za zadanie zabezpieczy\u0107 system nazw domenowych przed fa\u0142szywymi odpowiedziami. Podpisy kryptograficzne sprawiaj\u0105, \u017ce resolver potrafi zweryfikowa\u0107 autentyczno\u015b\u0107 rekordu i odrzuci\u0107 zmanipulowane pakiety. To realna ochrona przed cache poisoning i innymi <\/span><b><span data-contrast=\"auto\">atakami DNS<\/span><\/b><span data-contrast=\"auto\">. Ale ta sama cecha, kt\u00f3ra daje bezpiecze\u0144stwo, sprawia te\u017c, \u017ce <\/span><b><span data-contrast=\"auto\">DNSSEC nie wybacza b\u0142\u0119d\u00f3w<\/span><\/b><span data-contrast=\"auto\">: je\u015bli podpis jest niewa\u017cny albo brakuje rekordu DS u rodzica, ca\u0142a domena staje si\u0119 dla u\u017cytkownik\u00f3w niedost\u0119pna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Gdzie najcz\u0119\u015bciej pojawiaj\u0105 si\u0119 problemy<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W praktyce administratorzy najcz\u0119\u015bciej potykaj\u0105 si\u0119 w trzech miejscach:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Niesp\u00f3jno\u015b\u0107 DS u rodzica<\/span><\/b><span data-contrast=\"auto\"> \u2014 KSK zostaje zmieniony, ale wpis DS w rejestrze nie. Resolver waliduj\u0105cy nie ufa ju\u017c odpowiedziom.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Wygas\u0142e podpisy (RRSIG)<\/span><\/b><span data-contrast=\"auto\"> \u2014 brak automatycznego odnowienia sprawia, \u017ce rekordy wygl\u0105daj\u0105 na \u201eprzeterminowane\u201d i s\u0105 odrzucane.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Nieprzemy\u015blana rotacja kluczy<\/span><\/b><span data-contrast=\"auto\"> \u2014 rollover ZSK czy KSK przeprowadzony bez planu powoduje, \u017ce cz\u0119\u015b\u0107 odpowiedzi jest nieweryfikowalna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Ka\u017cdy z tych scenariuszy ko\u0144czy si\u0119 tym samym: resolver zwraca SERVFAIL, a u\u017cytkownicy zg\u0142aszaj\u0105, \u017ce \u201estrona nie dzia\u0142a\u201d.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Lekcja z rynku<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Nie jest to teoria. W marcu 2015 HBO NOW mia\u0142o problemy z dost\u0119pno\u015bci\u0105 w\u015br\u00f3d klient\u00f3w korzystaj\u0105cych z waliduj\u0105cych resolver\u00f3w. Pow\u00f3d? Nieprawid\u0142owo skonfigurowane <\/span><b><span data-contrast=\"auto\">DNSSEC<\/span><\/b><span data-contrast=\"auto\">. Cz\u0119\u015b\u0107 u\u017cytkownik\u00f3w nie mog\u0142a w og\u00f3le dosta\u0107 si\u0119 do serwisu, a rozwi\u0105zaniem awaryjnym by\u0142o wy\u0142\u0105czenie podpis\u00f3w i p\u00f3\u017aniejsze ich poprawne wdro\u017cenie. To pokaza\u0142o, \u017ce brak planu awaryjnego bywa r\u00f3wnie gro\u017any jak brak samego DNSSEC.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Jak wdra\u017ca\u0107 bezpiecznie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Tutaj najwa\u017cniejsze s\u0105 procesy, a nie pojedyncze komendy konfiguracyjne. Warto pami\u0119ta\u0107 o kilku zasadach:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Automatyzacja podpisywania<\/span><\/b><span data-contrast=\"auto\"> \u2014 r\u0119czne odnowienia podpis\u00f3w pr\u0119dzej czy p\u00f3\u017aniej zawiod\u0105.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Harmonogram rotacji<\/span><\/b><span data-contrast=\"auto\"> \u2014 ZSK powinien zmienia\u0107 si\u0119 cz\u0119\u015bciej, KSK rzadziej, ale ka\u017cda rotacja musi by\u0107 zsynchronizowana z rejestrem.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Monitoring krytycznych metryk<\/span><\/b><span data-contrast=\"auto\"> \u2014 liczba SERVFAIL, daty wyga\u015bni\u0119cia RRSIG, obecno\u015b\u0107 DS u rodzica.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Plan awaryjny<\/span><\/b><span data-contrast=\"auto\"> \u2014 kto kontaktuje si\u0119 z rejestratorem, jak szybko mo\u017cna opublikowa\u0107 nowy DS, kiedy i jak u\u017cy\u0107 <\/span><i><span data-contrast=\"auto\">negative trust anchor<\/span><\/i><span data-contrast=\"auto\"> na resolverach.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">DNSSEC<\/span><\/b><span data-contrast=\"auto\"> realnie podnosi poziom <\/span><b><span data-contrast=\"auto\">bezpiecze\u0144stwa DNS<\/span><\/b><span data-contrast=\"auto\">, ale wymaga dojrza\u0142ego podej\u015bcia. To nie \u201ew\u0142\u0105cz i zapomnij\u201d, lecz ci\u0105g\u0142y proces: automatyzacja, monitoring, rotacje i testy awaryjne. Zyskiem jest ochrona przed jednymi z najgro\u017aniejszych <\/span><b><span data-contrast=\"auto\">atak\u00f3w DNS<\/span><\/b><span data-contrast=\"auto\">, a kosztem \u2014 konieczno\u015b\u0107 utrzymywania procedur.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Dobre_praktyki_TTL_rekursja_autorytatywnosc_transfery_stref_i_split-horizon\"><\/span><b><span data-contrast=\"none\">Dobre praktyki: TTL, rekursja, autorytatywno\u015b\u0107, transfery stref i split-horizon<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">W DNS nie ma \u201ema\u0142ych\u201d ustawie\u0144. Niewinne warto\u015bci TTL, otwarta rekursja czy niechc\u0105cy pozostawiony transfer strefy potrafi\u0105 sta\u0107 si\u0119 pocz\u0105tkiem powa\u017cnych incydent\u00f3w. To troch\u0119 jak w lotnictwie: drobny b\u0142\u0105d w procedurze startowej mo\u017ce doprowadzi\u0107 do katastrofy. Dlatego w zarz\u0105dzaniu DNS m\u00f3wi si\u0119 o <\/span><b><span data-contrast=\"auto\">higienie operacyjnej<\/span><\/b><span data-contrast=\"auto\"> \u2014 zestawie zasad, kt\u00f3re same w sobie nie s\u0105 skomplikowane, ale wymagaj\u0105 dyscypliny i powtarzalno\u015bci.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">TTL \u2014 decyzja strategiczna, nietechniczny detal<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Wyobra\u017amy sobie sklep internetowy, kt\u00f3ry zmienia dostawc\u0119 hostingu. Je\u015bli rekord A mia\u0142 TTL ustawiony na 48 godzin, to cz\u0119\u015b\u0107 u\u017cytkownik\u00f3w nadal b\u0119dzie kierowana do starej infrastruktury nawet dwa dni po migracji. To nie tylko ryzyko niedost\u0119pno\u015bci, ale i problem ksi\u0119gowy: zam\u00f3wienia sk\u0142adane w \u201estarej\u201d wersji systemu mog\u0105 nie trafia\u0107 do nowej bazy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Z drugiej strony, zbyt kr\u00f3tki TTL oznacza niepotrzebne obci\u0105\u017cenie resolver\u00f3w i autorytatywnych serwer\u00f3w, a przy globalnej skali \u2014 realne koszty. Dlatego firmy zwykle przyjmuj\u0105 polityk\u0119 mieszan\u0105:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">rekordy stabilne (NS, MX, SPF) \u2192 TTL liczony w godzinach lub dniach,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">rekordy dynamiczne (A\/AAAA dla aplikacji w chmurze, load balancer\u00f3w) \u2192 TTL liczony w minutach,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">w okresach migracji \u2192 TTL tymczasowo obni\u017cony, by zmiany rozchodzi\u0142y si\u0119 szybko.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Rekursja i autorytatywno\u015b\u0107 \u2014 nie mieszaj r\u00f3l<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Historia zna dziesi\u0105tki przypadk\u00f3w, gdy administrator zostawi\u0142 w\u0142\u0105czon\u0105 rekursj\u0119 na serwerze autorytatywnym. Efekt? Serwer stawa\u0142 si\u0119 \u201eotwartym resolverem\u201d, a w r\u0119kach atakuj\u0105cych \u2014 maszyn\u0105 do amplifikacji w atakach DDoS.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Najlepsza praktyka to absolutny rozdzia\u0142 r\u00f3l:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"15\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">autorytatywne serwery<\/span><\/b><span data-contrast=\"auto\"> \u2014 odpowiadaj\u0105 wy\u0142\u0105cznie za swoje strefy, bez rekursji,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"15\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">rekursywne resolvery<\/span><\/b><span data-contrast=\"auto\"> \u2014 dzia\u0142aj\u0105 osobno, w sieci kontrolowanej, najlepiej z ograniczeniem \u017ar\u00f3de\u0142 zapyta\u0144 do w\u0142asnej organizacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Taki model nie tylko podnosi bezpiecze\u0144stwo, ale te\u017c u\u0142atwia diagnostyk\u0119. Je\u015bli resolver si\u0119 d\u0142awi, wiadomo, \u017ce problem le\u017cy w warstwie u\u017cytkownik\u00f3w, a nie w infrastrukturze autorytatywnej.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Transfery stref \u2014 wygoda kontra ryzyko ujawnienia mapy sieci<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">AXFR i IXFR s\u0105 jak kopia zapasowa dla serwer\u00f3w wt\u00f3rnych. Jednak otwarty AXFR to jak publiczne udost\u0119pnienie schematu ca\u0142ej infrastruktury. Atakuj\u0105cy w kilka sekund poznaje wszystkie subdomeny, rekordy i serwery us\u0142ugowe.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Dlatego praktyka jest jasna:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">ograniczaj transfery tylko do zaufanych adres\u00f3w,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">stosuj autoryzacj\u0119 (TSIG),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">preferuj IXFR, bo przesy\u0142a tylko r\u00f3\u017cnice, a nie ca\u0142\u0105 stref\u0119.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">To jedna z najprostszych zmian, kt\u00f3re drastycznie zmniejszaj\u0105 ryzyko wycieku wra\u017cliwych danych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Split-horizon \u2014 dwa \u015bwiaty w jednym DNS<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Koncepcja split-horizon jest kusz\u0105ca: ta sama domena mo\u017ce mie\u0107 r\u00f3\u017cne odpowiedzi w zale\u017cno\u015bci od tego, sk\u0105d pochodzi zapytanie. Wewn\u0119trzni pracownicy widz\u0105 np. <\/span><span data-contrast=\"auto\">intranet.company.com<\/span><span data-contrast=\"auto\"> kieruj\u0105cy na prywatny adres IP, a u\u017cytkownicy zewn\u0119trzni dostaj\u0105 zupe\u0142nie inn\u0105 odpowied\u017a.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Problem pojawia si\u0119, gdy te dwa \u015bwiaty si\u0119 mieszaj\u0105. B\u0142\u0119dna konfiguracja mo\u017ce spowodowa\u0107, \u017ce rekordy wewn\u0119trzne wyciekn\u0105 na zewn\u0105trz, daj\u0105c atakuj\u0105cym gotow\u0105 map\u0119 us\u0142ug. Jeszcze gorszy scenariusz to konflikt nazw \u2014 cz\u0119\u015b\u0107 u\u017cytkownik\u00f3w trafia do \u201epublicznej\u201d wersji serwisu, a cz\u0119\u015b\u0107 do wewn\u0119trznej, co generuje trudne do uchwycenia b\u0142\u0119dy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Dlatego split-horizon wymaga szczeg\u00f3lnej uwagi:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">regularnych test\u00f3w sp\u00f3jno\u015bci widok\u00f3w,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">jasnego planu nazewnictwa (\u017ceby domeny wewn\u0119trzne nie kolidowa\u0142y z publicznymi),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">monitoringu, kt\u00f3ry wychwyci przecieki rekord\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p>D<span data-contrast=\"auto\">obre praktyki DNS mog\u0105 wydawa\u0107 si\u0119 nudne w por\u00f3wnaniu z efektownymi <\/span><b><span data-contrast=\"auto\">atakami DNS<\/span><\/b><span data-contrast=\"auto\">, ale to w\u0142a\u015bnie one stanowi\u0105 pierwsz\u0105 lini\u0119 obrony. TTL, rekursja, transfery i split-horizon to nie \u201eszczeg\u00f3\u0142y konfiguracji\u201d, lecz decyzje, kt\u00f3re decyduj\u0105 o stabilno\u015bci i odporno\u015bci systemu. Wiele powa\u017cnych incydent\u00f3w w historii zaczyna\u0142o si\u0119 w\u0142a\u015bnie od zaniedba\u0144 w tych podstawach.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Monitoring_i_reagowanie_logi_telemetria_alerty_i_testy_integralnosci_bezpieczenstwa_DNS\"><\/span><b><span data-contrast=\"none\">Monitoring i reagowanie: logi, telemetria, alerty i testy integralno\u015bci bezpiecze\u0144stwa DNS<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">Nie ma bezpiecznego DNS bez monitoringu. Nawet najlepiej skonfigurowana strefa mo\u017ce w jednej chwili sta\u0107 si\u0119 polem <\/span><b><span data-contrast=\"auto\">ataku DNS<\/span><\/b><span data-contrast=\"auto\">, a administrator dowiaduje si\u0119 o problemie\u2026 od sfrustrowanych u\u017cytkownik\u00f3w. To najgorszy scenariusz. Dlatego prawdziwe <\/span><b><span data-contrast=\"auto\">bezpiecze\u0144stwo DNS<\/span><\/b><span data-contrast=\"auto\"> zaczyna si\u0119 od proaktywnego podej\u015bcia: ci\u0105g\u0142ego podgl\u0105du, pomiar\u00f3w i szybkiej reakcji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"none\">DNS jako \u201eczarna skrzynka\u201d sieci<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">W logach DNS zapisane s\u0105 historie pr\u00f3b nadu\u017cy\u0107, pierwsze sygna\u0142y infekcji i anomalie, kt\u00f3re zdradzaj\u0105 tunelowanie danych. Administratorzy cz\u0119sto m\u00f3wi\u0105, \u017ce <\/span><b><span data-contrast=\"auto\">\u201ekto kontroluje DNS, ten widzi wszystko\u201d<\/span><\/b><span data-contrast=\"auto\">. Ale widzie\u0107 nie wystarczy \u2013 trzeba wiedzie\u0107, <\/span><i><span data-contrast=\"auto\">na co patrze\u0107<\/span><\/i><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Co monitorowa\u0107 na co dzie\u0144<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Zamiast zbiera\u0107 wszystkie dane bez \u0142adu, lepiej skupi\u0107 si\u0119 na kilku kluczowych metrykach:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"14\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Jako\u015b\u0107 odpowiedzi:<\/span><\/b><span data-contrast=\"auto\"> udzia\u0142 kod\u00f3w NXDOMAIN, SERVFAIL, REFUSED \u2013 skoki to sygna\u0142 awarii albo ataku.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"14\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Czas odpowiedzi:<\/span><\/b><span data-contrast=\"auto\"> wzrost latency to pierwszy objaw problem\u00f3w z autorytatywnymi serwerami.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"14\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Rozmiar i charakter zapyta\u0144:<\/span><\/b><span data-contrast=\"auto\"> d\u0142ugie etykiety o wysokiej entropii wskazuj\u0105 na mo\u017cliwe tunelowanie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"14\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Walidacja DNSSEC:<\/span><\/b><span data-contrast=\"auto\"> czas do wyga\u015bni\u0119cia podpis\u00f3w RRSIG, obecno\u015b\u0107 rekordu DS u rodzica.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Ka\u017cdy z tych wska\u017anik\u00f3w powinien mie\u0107 zdefiniowany pr\u00f3g alarmowy \u2013 inaczej monitoring zamieni si\u0119 w zbieranie statystyk do szuflady.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Scenariusze \u201eczerwonej lampki\u201d<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Lawina NXDOMAIN<\/span><\/b><span data-contrast=\"auto\"> \u2013 mo\u017ce oznacza\u0107 atak typu random subdomain, kt\u00f3ry ma za zadanie zajecha\u0107 resolvery.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Nag\u0142y wzrost odpowiedzi SERVFAIL<\/span><\/b><span data-contrast=\"auto\"> \u2013 najcz\u0119\u015bciej problem z podpisami DNSSEC albo b\u0142\u0119dna delegacja.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Nieproporcjonalnie du\u017cy udzia\u0142 zapyta\u0144 TCP<\/span><\/b><span data-contrast=\"auto\"> \u2013 mo\u017cliwe ataki amplifikacyjne, przeci\u0105\u017cenie UDP, albo problemy z EDNS.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Wzrost unikalnych subdomen w kr\u00f3tkim czasie<\/span><\/b><span data-contrast=\"auto\"> \u2013 klasyczny objaw tunelowania lub test\u00f3w skanera.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Testy integralno\u015bci \u2013 jak crash testy dla DNS<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Sam monitoring nie wystarczy. Trzeba aktywnie sprawdza\u0107, czy wszystko dzia\u0142a tak, jak powinno:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Linting strefy<\/span><\/b><span data-contrast=\"auto\"> \u2013 automatyczne narz\u0119dzia wykrywaj\u0105 osierocone rekordy, b\u0142\u0119dne NS czy problemy z SOA.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Symulacja rekursji<\/span><\/b><span data-contrast=\"auto\"> \u2013 testy z r\u00f3\u017cnych lokalizacji pokazuj\u0105, czy odpowiedzi s\u0105 sp\u00f3jne globalnie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Kontrola split-horizon<\/span><\/b><span data-contrast=\"auto\"> \u2013 sprawdzenie, czy rekordy wewn\u0119trzne nie \u201eprzeciekaj\u0105\u201d do widoku publicznego.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3><b><span data-contrast=\"none\">Kultura reagowania \u2013 od alertu do dzia\u0142ania<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Najwi\u0119ksz\u0105 r\u00f3\u017cnic\u0119 robi nie samo wykrycie, ale szybko\u015b\u0107 reakcji. Dlatego zespo\u0142y SOC\/NOC powinny dzia\u0142a\u0107 wed\u0142ug runbook\u00f3w:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ol>\n<li><b><span data-contrast=\"auto\">Kto odbiera alert<\/span><\/b><span data-contrast=\"auto\"> \u2013 czy jest dy\u017curny, czy wszyscy czekaj\u0105, a\u017c kto\u015b \u201ezauwa\u017cy\u201d.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Co sprawdza jako pierwsze<\/span><\/b><span data-contrast=\"auto\"> \u2013 np. status DS, logi resolvera, test z zewn\u0119trznego vantage point.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Kogo informuje<\/span><\/b><span data-contrast=\"auto\"> \u2013 aplikacje, helpdesk, rejestratora.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Jak komunikuje problem klientom<\/span><\/b><span data-contrast=\"auto\"> \u2013 nie ka\u017cdy b\u0142\u0105d DNS trzeba t\u0142umaczy\u0107 technicznie, ale brak informacji jest jeszcze gorszy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Plan_naprawczy_i_audyt_ciagly_jak_nie_wpasc_drugi_raz_w_te_same_bledy_DNS\"><\/span><b><span data-contrast=\"none\">Plan naprawczy i audyt ci\u0105g\u0142y: jak nie wpa\u015b\u0107 drugi raz w te same b\u0142\u0119dy DNS<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">Najwi\u0119kszym grzechem w zarz\u0105dzaniu DNS nie jest sam <\/span><b><span data-contrast=\"auto\">b\u0142\u0105d<\/span><\/b><span data-contrast=\"auto\">, ale brak nauki z incydentu. Organizacje bardzo cz\u0119sto gasz\u0105 po\u017car, przywracaj\u0105 us\u0142ug\u0119, a potem\u2026 wracaj\u0105 do starych praktyk. Efekt? Kolejny kryzys za miesi\u0105c. Dlatego skuteczna strategia to nie jednorazowe poprawki, tylko <\/span><b><span data-contrast=\"auto\">ci\u0105g\u0142y audyt i automatyzacja<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Dlaczego audyt ma znaczenie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W DNS zmiany bywaj\u0105 drobne i cz\u0119ste: nowa subdomena, migracja hostingu, w\u0142\u0105czenie <\/span><b><span data-contrast=\"auto\">DNSSEC<\/span><\/b><span data-contrast=\"auto\">, test split-horizon. Ka\u017cda taka zmiana mo\u017ce nie\u015b\u0107 nowe ryzyka. Regularny audyt pozwala z\u0142apa\u0107 problemy, zanim zrobi\u0105 to klienci. To jak przegl\u0105d techniczny samochodu \u2014 lepiej wymieni\u0107 klocki hamulcowe w serwisie ni\u017c podczas hamowania na autostradzie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Elementy skutecznego planu naprawczego<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ol>\n<li><b><span data-contrast=\"auto\">Priorytetyzacja ryzyk<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Najpierw zamykamy luki najbardziej niebezpieczne: otwarty AXFR, rekursja na serwerach autorytatywnych, wygas\u0142e podpisy DNSSEC.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Zarz\u0105dzanie zmian\u0105<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Ka\u017cda modyfikacja DNS powinna mie\u0107 plan wycofania. Przyk\u0142ad: przed migracj\u0105 us\u0142ug obni\u017c TTL, tak by w razie b\u0142\u0119du szybciej przywr\u00f3ci\u0107 poprzedni\u0105 konfiguracj\u0119.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">DNS jako kod<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Traktuj strefy jak kod \u017ar\u00f3d\u0142owy. Przechowuj w repozytorium, przegl\u0105daj zmiany, automatyzuj testy przed publikacj\u0105.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Testy odtwarzania<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Raz na kwarta\u0142 sprawd\u017a, czy potrafisz odtworzy\u0107 ca\u0142\u0105 konfiguracj\u0119 z backupu. To \u0107wiczenie, kt\u00f3re ujawnia, czy dokumentacja i kopie s\u0105 faktycznie kompletne.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Audyty okresowe<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Regularnie sprawdzaj: warto\u015bci TTL, listy ACL, zgodno\u015b\u0107 split-horizon, wygasanie rekord\u00f3w DS i RRSIG.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<h3><b><span data-contrast=\"none\">Automatyzacja \u2014 najlepszy sprzymierzeniec<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">R\u0119czne zarz\u0105dzanie DNS jest jak prowadzenie samochodu bez pas\u00f3w bezpiecze\u0144stwa. Przy ma\u0142ej skali \u201ejako\u015b dzia\u0142a\u201d, ale przy wi\u0119kszej liczbie stref i subdomen ko\u0144czy si\u0119 b\u0142\u0119dami. Automatyzacja podpisywania stref, monitorowania wa\u017cno\u015bci RRSIG czy sprawdzania rekord\u00f3w DS minimalizuje ryzyko ludzkiego potkni\u0119cia.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Kultura \u201epost-mortem\u201d<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Po ka\u017cdym incydencie DNS warto spisa\u0107 kr\u00f3tkie post-mortem:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">co si\u0119 wydarzy\u0142o,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">jak d\u0142ugo trwa\u0142 problem,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">jakie by\u0142y skutki dla biznesu,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">jakie zmiany w procesach wprowadzono, by nie powt\u00f3rzy\u0142 si\u0119 ponownie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Bez tego organizacja kr\u0119ci si\u0119 w k\u00f3\u0142ko, a <\/span><b><span data-contrast=\"auto\">DNS management errors<\/span><\/b><span data-contrast=\"auto\"> wracaj\u0105 jak bumerang.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Plan naprawczy i audyt ci\u0105g\u0142y to nie biurokracja. To strategia, kt\u00f3ra zamienia DNS z \u201epunktu awarii\u201d w przewidywalny i odporny element infrastruktury. Kluczem jest konsekwencja: priorytetyzacja ryzyk, automatyzacja proces\u00f3w, testy odtwarzania i kultura uczenia si\u0119 na b\u0142\u0119dach. Wtedy nawet je\u015bli pojawi si\u0119 incydent, b\u0119dzie on kr\u00f3tkim epizodem, a nie katastrof\u0105 biznesow\u0105.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dlaczego DNS jest krytyczny dla dost\u0119pno\u015bci i bezpiecze\u0144stwa\u00a0 System nazw domenowych (DNS) to kr\u0119gos\u0142up Internetu. Ka\u017cde po\u0142\u0105czenie u\u017cytkownika z aplikacj\u0105, serwisem czy us\u0142ug\u0105 w chmurze zaczyna si\u0119 od przet\u0142umaczenia przyjaznej dla cz\u0142owieka nazwy domenowej na adres IP. Bez tego procesu ca\u0142a komunikacja oparta na domenach stan\u0119\u0142aby w miejscu. To sprawia, \u017ce DNS jest jednocze\u015bnie punktem [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1397,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[99],"tags":[128,193],"product":[165],"topic":[167],"sycope_author":[249],"class_list":["post-2584","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-cyberbezpieczenstwo","tag-dns-pl","product-security-pl","topic-bezpieczenstwo-sieci","sycope_author-marcin-kazmierczak"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/comments?post=2584"}],"version-history":[{"count":4,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2584\/revisions"}],"predecessor-version":[{"id":2842,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2584\/revisions\/2842"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media\/1397"}],"wp:attachment":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media?parent=2584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/categories?post=2584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/tags?post=2584"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/product?post=2584"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/topic?post=2584"},{"taxonomy":"sycope_author","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/sycope_author?post=2584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}