IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Q&A: DNS inventor Paul Mockapetris

Four months after serious flaws in the internet’s addressing system were proven, its inventor is looking beyond the threats to help bolster web security.

Earlier this year, researcher Dan Kaminsky outlined flaws in the internet Domain Name System (DNS), which led to massive efforts on behalf of multiple vendors to patch vulnerable systems.

The flaw, which has been used by hackers to poison the servers that translate web addresses into internet protocol addresses and redirect unsuspecting users to spoofed malicious sites to infect their PCs, has also led to political action.

Authorities, including the European Union (EU) agencies, have been involved in promoting the adoption of standard technologies like Multiprotocol Label Switching (MPLS), IPv6 and Domain Name System Security Extensions (DNSSEC) to combat the vulnerability.

Dr. Paul Mockapetris, the inventor of DNS and chairman and chief scientist at IP address infrastructure software vendor Nominum, has been working alongside other security experts and agencies at the same time to tackle the flaw.

Earlier this week, he spoke to IT PRO about the issues involved and the challenges the IT industry faces to strengthen DNS and web security overall.

IT PRO: The DNS attack vector outlined by Dan Kaminsky in June has been one of the major web security issues of 2008. Given your involvement in the first ever DNS implementation, what are you working on towards successfully patching this flaw?

Mockapetris: We develop with DNS and DCHP [Dynamic Host Configuration Protocol] software for large carriers that provide services to a total 150 million broadband subscribers worldwide. When it comes to the Kaminsky attack, we're part of the consortium of vendors and organisations that have addressed ways to put new security layers over the DNS system.

Our carriers demand it of us and it's our job to meet or exceed those expectations beyond what might be expected in say, the open source world.

We saw many attacks launched against us, but have successfully dealt with every one. And our focus has now moved onto additional security measures, beyond DNS. For instance, in the DNSSEC [DNS Security Extensions] era of the future, it will be possible to distribute reputation information using digital signature technology to the filters used by email and virus filters to remove spam and block malicious or pornographic sites.

In some places, like New York State and California, they are developing them as part of regulations to ensure it's possible for people to expect to have a trusted experience of the internet. And we're seeing the work of ENISA and political movement towards making this part of the expectation of users who want to have a trusted experience on a website too.

Looking back, were you surprised that the system you originally designed for distributing naming data could be subverted in such a high-profile way?

I was the inventor' of DNS in that I designed it and deployed the first implementation 25 years ago. But I would say that design only goes up through floors one and two of its development.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security

Why convenience is the biggest threat to your security

8 Aug 2022
Electrical explosion reported at Google's Iowa data centre
data centres

Electrical explosion reported at Google's Iowa data centre

9 Aug 2022