Half of .gov Sites Fail DNSSEC Test

netbuzz writes "US federal government Web sites were mandated to have begun deploying DNS Security Extensions (DNSSEC) by Dec. 31, 2009, but a recent check shows that 51 percent have still failed to do so. That does represent a marked increase over the 20 percent that had complied as of a year ago. 'But if you think the government should be fully deployed by now, it's a disappointing number,' says Mark Beckett, vice president of marketing and product management for Secure64, who conducted the study."

Comments

Re:Hello Slashvertisement

[hAckz0r]

Likely true. But then history has shown that when the Government is embarrassingly hacked on a wide scale basis, due to the lack of DNS security, they will be dragged kicking a clawing into the 21st century. Sooner or later some clueless congressman submits a bill that "fixes" the problem where the 'problem' is not even understood much less 'defined' adequately. In the mean time those doing business over the internet will have moved forward so that they can protect their profits from man-in-the-middle attacks once the customers start taking them to court with class action suits. Sadly, this means you have to get screwed and then complain before things actually get better.

After that things will start to progress as defined by this thing called 'common sense'. Everybody knows it needs doing, its just that nobody wants to financially put the effort into DNSSEC or IPv6 until everyone else has done the hard work and they can simply sit back and flip some switch, or hire someone with years of experience with it that knows how to turn it on.

btw - If you use Firefox as a browser look into the "DNSSEC Validator" plugin and see just how many websites there are that you can really trust. Very few. Awareness is half the battle. Note the News story ITFA can not be trusted, as it could be hosted in North Korea as a propaganda campaign and we wouldn't know unless you have a way to check that it really is from 'NetworkWorld'. NetworkWorld's web site in not secured with DNSSEC, so who can tell. Why should we even assume the story is true if by extension we can't trust who wrote it?

Cricket Liu on DNSSEC

[RazzleDazzle]

Coincidentally I was just yesterday at a DNSSEC seminar presented by Cricket Liu. While obscenely complicated compared to the more or less basic operation of a non-DNSSEC name server, it is super easy to (and really operationally required IMHO to) automate the entire DNSSEC part of DNS administration. Of course he showed his own employers DNS tool (he works for infoblox.com) but there are other choices and methods of automating and he did not really make it into a big sales pitch for his employer, just a simple screenshot showing its ease of use and a few minutes to describe it.

Anyways, I plan to start really investigating the deployment of DNSSEC now.