topic Re: DNS Risk Catagory 4? in General Topics

DNS Risk Catagory 4?

numberall — Fri, 09 Jul 2010 16:56:18 GMT

Hello,

I don't understand why DNS forwarder traffic is considered Risk Catagory 4? I mean how can you use the internet without DNS?

Thanks,

Daniel

Re: DNS Risk Catagory 4?

mharding — Fri, 09 Jul 2010 19:23:31 GMT

Exactly. Because it is so widely used, it is easily exploitable. The ACC breakdown should list why the app was give a 4.

This document should also help break down how the research team determines risk level:

https://live.paloaltonetworks.com/docs/DOC-1090

Take the risk level with a grain of salt. It just gives you an idea for potential threats on the network.

You can also modify the risk level in the PAN OS by clicking on Object > Applications, then clicking on the the app, and then selecting "customize" next to the risk number.

Re: DNS Risk Catagory 4?

numberall — Fri, 09 Jul 2010 21:04:25 GMT

Thanks for answering my question. While I appreciate that DNS can be abused, I don't think it warrents a 4. So I will take your advice and adjust the rating to my liking.

Thanks,

Daniel

Re: DNS Risk Catagory 4?

KKUTZERA — Mon, 13 Dec 2010 23:38:35 GMT

Hi,

I find myself in a similiar situation. With the DNS risk set to 4 it skews the overall safety of my network, and also hides other traffic from the Top risks on the Dashboard. I could lower the risk artificially, however will this compromise the appliances reaction actual DNS packet attacks? Will the system still exam and respond to actual attempts to exploit the vulnerabilities? Is there another alternative? Do I need to add a more specific definition of a "bad DNS" packet that can be filtered on?

Thanks to all who read and respond

Kevin Kutzera

New PA-500 administrator

Seattle, WA.

Re: DNS Risk Catagory 4?

kbrazil — Wed, 15 Dec 2010 23:05:50 GMT

Hi Kevin,

You can modify the risk level of the DNS app without worry. It will not affect DNS attack detection/protection. It is only used in reporting and in the ACC.

Cheers,

Kelly

Re: DNS Risk Catagory 4?

BobW — Tue, 01 May 2012 21:14:22 GMT

Will the custom risk levels hold through software updates?

Thanks
Bob

Re: DNS Risk Catagory 4?

KKUTZERA — Wed, 02 May 2012 00:26:14 GMT

I think you sent this to the wrong Kevin. I'd be interested in the answer.

Kevin Kutzera

Director, Information Service

Sent from iPad