Deploying DNSSEC

Architecture and Background

Paul Wouters - Deploying DNSSEC Deploying DNSSEC Although DNSSEC is still a moving target, it has matured enough for large scale experimenting. The first part of the presentation explains the new concepts in DNSSEC and the new record types introduced. Rudimentary knowledge of DNS is required.

Vulnerability Analysis

The second part of the presentation is a step-by-step guide using Bind to secure an existing zone. Participants who which to secure their own domain need to have the latest Bind9 snapshot and a copy of the zones they wish to secure. The third part of the presentation will demonstrate the interaction between the Registrant and the Registrar.

Exploitation and Demonstrations

The Dutch SECREG system will be demonstrated for securing .nl domains at the ccTLD. The VeriSign experiment will also be shown on how to secure the generic TLD's. Time permitting, participants are invited to try and compromise the Speaker's secured zones.

Remediation and Defensive Strategies

Paul Wouters has been involved with Linux networking and security since he co-founded the Dutch ISP "Xtended Internet" back in 1996. His first article about network security was published in LinuxJournal in 1997 Since then, he has written mostly for the Dutch spin-off of the German "c't magazine", focussing on Linux, networking and the impact of the digital world on society. He has presented papers at SANS, OSA, CCC and HAL. He is currently involved with the FreeS/WAN project, a Linux IPsec stack that aims to bring Opportunistic Encryption to everyone. For this feature, a secure DNS is needed, which triggered his interest in assisting the widespread use of DNSSEC. Wouters received his Bachelors degree in Education in 1993