The Fastest Way to Become a Backend Developer Online
Power BI Fundamentals - Create visualizations and dashboards from scratch
Overview
AI, Data Science & Cloud Certificates from Google, IBM & Meta — 40% Off
One plan covers every Professional Certificate on Coursera. 40% off Coursera Plus Annual.
Unlock All Certificates
Explore DNS in enterprise incident response, collection, analysis, and response in this 47-minute conference talk from Derbycon 2016. Delve into the importance of DNS and learn about various collection tools, including resolver logging, IDSS, and standalone DNS logging. Examine analysis techniques for fast-flux, DNS exfiltration/tunneling, DGA, and low prevalence domains. Discover common false positives and gain insights into Response Policy Zones (RPZ), their benefits, and potential pitfalls. Enhance your understanding of DNS infrastructure and its role in enterprise security.
Syllabus
Intro
Why care about DNS?
First a note about names
Collection Tools - Resolver logging
Collection Tools - IDSS
Collection Tools - Standalone DNS logging
Infrastructure
Analysis - fast-flux
Analysis - DNS Exfiltration/Tunneling
Analysis - DGA
Analysis - Low Prevalence Domains
Analysis - Common False Positives
RPZ Explained
What is RPZ good for?
RPZ Gotchas