DNS Risk Catagory 4?

[numberall]

Hello,

I don't understand why DNS forwarder traffic is considered Risk Catagory 4? I mean how can you use the internet without DNS?

Thanks,

Daniel

[mharding]

Exactly. Because it is so widely used, it is easily exploitable. The ACC breakdown should list why the app was give a 4.

This document should also help break down how the research team determines risk level:

https://live.paloaltonetworks.com/docs/DOC-1090

Take the risk level with a grain of salt. It just gives you an idea for potential threats on the network.

You can also modify the risk level in the PAN OS by clicking on Object > Applications, then clicking on the the app, and then selecting "customize" next to the risk number.

[numberall]

Thanks for answering my question. While I appreciate that DNS can be abused, I don't think it warrents a 4. So I will take your advice and adjust the rating to my liking.

Thanks,

Daniel

[KKUTZERA]

Hi,

I find myself in a similiar situation.  With the DNS risk set to 4 it skews the overall safety of my network, and also hides other traffic from the Top risks on the Dashboard.  I could lower the risk artificially, however will this compromise the appliances reaction actual DNS packet attacks?  Will the system still exam and respond to actual attempts to exploit the vulnerabilities?  Is there another alternative?  Do I need to add a more specific definition of a "bad DNS" packet that can be filtered on?

Thanks to all who read and respond

Kevin Kutzera

New PA-500 administrator

Seattle, WA.

[kbrazil]

Hi Kevin,

You can modify the risk level of the DNS app without worry.  It will not affect DNS attack detection/protection.  It is only used in reporting and in the ACC.

Cheers,

Kelly

[BobW]

Will the custom risk levels hold through software updates?

Thanks
Bob

[KKUTZERA]

I think you sent this to the wrong Kevin. I'd be interested in the answer.

Kevin Kutzera

Director, Information Service

Sent from iPad