Re: [cti-taxii] Questioning the wisdom of using DNS SRV records for TAXI

The major use case for SRV records is for internal system that talk to an internal DNS. Internal systems need to just work when connected to the network. For external systems, there might be lots of ways this could be done.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Oct 30, 2015, at 02:41, Trey Darley <trey@SOLTRA.COM> wrote:

Hi, y'all -

While from an architectural perspective using DNS SRV records to
support discovery in TAXII 2.0 is an elegant and obvious approach (cf.
[0]), when viewed from the perspective of operational security things
appear rather problematic. At the same time you're making it easy for
the blue team to discover your TAXII gateway, you're simultaneously
advertising it to the whole internet, including potential attackers.

Using DNS SRV records *internally* within an organization makes sense
but for public-facing discovery we should come up with an alternative
that's less advantageous to the blackhats.

[0]: https://taxiiproject.github.io/taxii2/rest-api/#dns-srv

--
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"No matter how hard you try, you can't make a baby in much less than 9
months. Trying to speed this up *might* make it slower, but it won't
make it happen any quicker." --RFC 1925

cti-taxii message