At the cyber frontline

Maan Tantawi, Regional Sales Manager, META at DNSFilter, discusses the rise of AI-generated threats, the growing challenge of Shadow AI, and why organisations need to rethink how they protect users across increasingly distributed environments.

How is the role of DNS-layer security evolving in enterprise defence?

We see DNS security right now as the gatekeeper of an infrastructure, across your estates, branches and all of the IT infrastructure in those distributed environments. We have a philosophy that detecting and remediating security threats is the classical approach, but blocking them is even better.

If you have a good mechanism to become that gatekeeper and block those DNS-based attacks, then you literally stop the attacks right at the gate. They don’t go to your devices, they don’t go to your applications and they don’t reach your users.

So this is where we see DNS right now as an instrumental complement to your existing security stack. And today, it is even more important because of the rise of AI threats.

How is AI changing the threat landscape?

AI threats right now are generating over 200,000 malicious domains daily.

Think about when you write code. Something that might take you a week, two weeks or three weeks, AI can do in half an hour or an hour. Now imagine that same AI being able to generate new domains and start attacking through those malicious domains. It’s getting more and more problematic.

We processed over seven trillion DNS queries in one month. We have around 200 nodes globally on our bare-metal infrastructure and a dual anycast network, with multiple failover mechanisms, redundancy and high availability.

The problem is that traditional threat feeds and manual detection and protection don’t scale when you’re dealing with AI-based attacks. So we have an AI-based threat analysis plane. We don’t only rely on traditional threat feeds; we’re actually able to detect and qualify new zero-day attacks on demand and in real time.

If we receive a query from a domain that we’ve never seen before, we will block it for 60 seconds. We take that domain internally and our AI system qualifies it and analyses it. Within those 60 seconds, it comes back and tells you: this is a malicious domain, we’re blocking it; or this is fine, go ahead.

So AI is built directly into the detection process?

Yes, AI is there organically, directly in the system.

If we have existing threats that we already know, we deal with them automatically. But if a new domain comes in that we’ve never seen before, your threat feeds are not going to help you with that new domain. In fact, DNSFilter identifies threats an average of 10 days ahead of traditional threat feeds, with some threats detected as much as 59 days earlier.

You’re not simply going to let it pass because it’s new. What if it’s malicious? And the probability that it’s malicious right now is much higher than it was before because you have over 200,000 malicious domains being generated daily.

Which organisations are most exposed to these threats?

Organisations with large and widely distributed environments are the ones that are particularly interested in this.

If you’re a larger organisation with a lot of users, your CISO and IT manager have to think about protecting employees as well as customers, inside the office, behind the network, and also when they’re roaming outside the office, whether they’re working from home or sitting in a coffee shop.

You also have to protect them on public and guest Wi-Fi. So it’s very important that DNS security protects you wherever you are and wherever you go — whether you’re at home, in the office, in a coffee shop or even using satellite connectivity on an airplane.

That’s really key.

What are some of the most common ways malicious domains are used to compromise users?

Almost every attack begins with a DNS lookup, your device asking ‘where is this domain?’ before it connects, and that’s exactly where we step in. What attackers do with those domains falls into a few patterns. The one you see most is phishing: an email that looks like your bank, a link to .co instead of .com, a login page that looks normal, and the moment you type your password, they have it, no malware involved.

Then there’s malware itself, where a compromised site pushes a download or an attachment you open quietly reaches out to a domain for its real payload. Once a machine is infected, it has to phone ho.me for instructions, and that’s a domain too, block it and the attack goes quiet, and you know which machine is the problem. You also run into cryptojacking, where a site burns your CPU mining crypto, and DNS tunneling, where stolen data is hidden inside DNS traffic to sneak it out. We cover all of that across more than ten threat categories, but the one most people overlook is Very New Domains – most of the damage happens in the first few days after registration, before threat feeds catch up, so we flag anything under 24 hours and anything under 30 days. That alone closes a lot of doors.

Are there particular sectors where you are seeing greater exposure?

All of them are exposed. Machines don’t differentiate. But the use cases, implications and potential damage are different.

Of course, financial services and banking are critical. So are the public sector and government. They have huge estates, they need long-term strategies, and there are greater implications around regulatory compliance.

Education is also becoming a very important sector to protect. A lot of schools right now are getting access to connectivity through satellite connectivity, for example in Africa and the Middle East. But that access also brings a lot of threats with it.

Healthcare is similar. You have a lot of sensitive patient information, but more importantly, there is also a lot of specialised IoT equipment that is mission-critical and could be compromised by malware and malicious attacks.

Retail and hospitality are interesting as well because of the nature of guest Wi-Fi. You have all these bring-your-own devices logging into public and guest Wi-Fi. Organisations serving those customers need to protect them. Otherwise, you could have severe damage not only to your customers but also to your own reputation.

If you’re a mall and your Wi-Fi is compromised, chances are you’re going to see a lot fewer people coming in over the next few days. That’s another dimension organisations have to think about.

What about Shadow IT and the growing use of autonomous AI tools within organisations?

Shadow AI right now is becoming the new trend of Shadow IT. How do you prevent data leakage when people are using their own personal AI tools to process some work? That’s a huge problem.

We have something called CyberSight, which provides user behaviour analytics and insights. Beyond seeing the DNS query that was requested, you can find out who requested it, what they did, which website they went to, what the URL was, how long they were on that website, how long they were active and how long they were idle.

More importantly, what tools were they using?

They could be using Dropbox or other types of storage where they can upload company-sensitive information without the IT administration knowing about it. Or they’re using an AI tool that isn’t sanctioned by the company; for example, they’re using ChatGPT when the company has sanctioned another tool.

When you’re able to see these kinds of insights, you’re able to provide stricter filtering and access to those tools. You can also do app-aware blocking, which basically blocks the application and the domains behind that application.

So you can say, okay, we’re no longer going to allow anybody with this policy attached to use ChatGPT because it isn’t sanctioned. We have another AI tool that is sanctioned.

Right then and there, you have mechanisms and methods to combat data leakage and Shadow AI.