Over the last week, DNSFilter has seen an increase in phishing attempts. In addition, we’re keeping an eye on a lot of cyber attacks that are getting reported including advanced phishing attacks, PTO phishing attacks, pig butchering and the targeted attacks on critical infrastructure.
Being a highly customizable product, administrators create policies to ensure they are in line with your organization's or clients’ needs. We encourage our customers to regularly review configured policies within DNSFilter as your needs change and as we add new options.
In order to help improve the overall security of your organization, we wanted to highlight some policy options that may not be as well known.
Let’s start with some options to block newly seen domains by DNSFilter:
*Note: For a domain to be categorized as New or Very New, it needs to be seen (resolved) by DNSFilter first.
One additional option to further increase protection for newly registered domains but not yet seen (resolved) by DNSFilter is under the Extra Settings section:
*Note: Because the Block Uncategorized Sites category can impact the user experience, we recommend turning it on individually after a policy is applied and monitoring results.
Another option that may be helpful for any resolved domain is blocking parked domains:
Lastly, with Google introducing new top-level domains, attacks are already being seen on these new domains. DNSFilter can block TLDs simply by entering the TLD (without a ‘.’) in the Block List. For example, to block the entire “.zip” TLD, you would enter “zip” in the Block List.
To summarize some suggested policy configurations:
| Baseline Threat Protection | Advanced Threat Protection |
|---|---|
| Botnet | Botnet |
| Cryptomining | Cryptomining |
| Malware | Malware |
| Very New Domains | New Domains |
| Phishing & Deception | Phishing & Deception |
| Proxy & Filter Avoidance | Proxy & Filter Avoidance |
| Translation Sites | |
| Extra Settings: Block Uncategorized Sites | |
| Extra Settings: Parked Sites and Domains |
*Note: For Advanced Protection, turn on the categories under Extra Settings individually after applying baseline protection. Watch for tickets generated from users as well as our Query Log to decide if they should remain on. Security is always a balance between protection and usability. Your users need to have enough access to get their work done, in an environment that restricts them from accessing harmful content.
Lastly, no security vendor can guarantee 100% protection, so we encourage organizations to use a layered approach for security which includes security awareness training.