Modül dersleri (1/4)
Superficie di attacco DNS
The DNS attack surface
DNS security covers more than the records in a zone. Important assets include the registrar account, authoritative servers, recursive resolvers, signing keys, management APIs, and the network paths between them. An attacker may target account recovery, steal credentials, abuse an open resolver, or tamper with data before it is validated.
Start with an asset and trust boundary. Ask who can change a record, who can query a resolver, where secrets are stored, and how an incident would be detected. Use separate administrator accounts, multi-factor authentication, least privilege, backups, and change logs. DNSSEC helps detect unauthorized data changes in transit; it does not stop an attacker who controls the publishing account.
Treat each scenario as a fictional lab. Identify the asset, the possible abuse, and the defensive control that interrupts it.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
Does DNSSEC prevent changes made through a compromised DNS account?