Q&A: DNS inventor Paul Mockapetris

Four months after serious flaws in the internet’s addressing system were proven, its inventor is looking beyond the threats to help bolster web security.

Earlier this year, researcher Dan Kaminsky outlined flaws in the internet Domain Name System (DNS), which led to massive efforts on behalf of multiple vendors to patch vulnerable systems.

The flaw, which has been used by hackers to poison the servers that translate web addresses into internet protocol addresses and redirect unsuspecting users to spoofed malicious sites to infect their PCs, has also led to political action.

Authorities, including the European Union (EU) agencies, have been involved in promoting the adoption of standard technologies like Multiprotocol Label Switching (MPLS), IPv6 and Domain Name System Security Extensions (DNSSEC) to combat the vulnerability.

Dr. Paul Mockapetris, the inventor of DNS and chairman and chief scientist at IP address infrastructure software vendor Nominum, has been working alongside other security experts and agencies at the same time to tackle the flaw.

Advertisement - Article continues below
Advertisement - Article continues below

Earlier this week, he spoke to IT PRO about the issues involved and the challenges the IT industry faces to strengthen DNS and web security overall.

IT PRO: The DNS attack vector outlined by Dan Kaminsky in June has been one of the major web security issues of 2008. Given your involvement in the first ever DNS implementation, what are you working on towards successfully patching this flaw?

Mockapetris: We develop with DNS and DCHP [Dynamic Host Configuration Protocol] software for large carriers that provide services to a total 150 million broadband subscribers worldwide. When it comes to the Kaminsky attack, we're part of the consortium of vendors and organisations that have addressed ways to put new security layers over the DNS system.

Our carriers demand it of us and it's our job to meet or exceed those expectations beyond what might be expected in say, the open source world.

We saw many attacks launched against us, but have successfully dealt with every one. And our focus has now moved onto additional security measures, beyond DNS. For instance, in the DNSSEC [DNS Security Extensions] era of the future, it will be possible to distribute reputation information using digital signature technology to the filters used by email and virus filters to remove spam and block malicious or pornographic sites.

In some places, like New York State and California, they are developing them as part of regulations to ensure it's possible for people to expect to have a trusted experience of the internet. And we're seeing the work of ENISA and political movement towards making this part of the expectation of users who want to have a trusted experience on a website too.

Advertisement - Article continues below

Looking back, were you surprised that the system you originally designed for distributing naming data could be subverted in such a high-profile way?

I was the inventor' of DNS in that I designed it and deployed the first implementation 25 years ago. But I would say that design only goes up through floors one and two of its development.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now

Most Popular

Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020