Skip to content

security-settings.md

Latest commit

 

History

History
89 lines (77 loc) · 3.27 KB

security-settings.md

File metadata and controls

89 lines (77 loc) · 3.27 KB
Raw
title Security Settings
impact HIGH
impactDescription Configuration of advanced threat protection and security features
type capability
tags
threat intelligence
google safe browsing
cryptojacking
dns rebinding
security
tlds

Security settings

Advanced threat protection and security configuration

Configure advanced security features to protect your network from various online threats.

Core protection features

  • Threat Intelligence Feeds: Block domains identified as distributing malware, launching phishing attacks, or hosting command and control servers using highly reputable intelligence feeds updated in real-time.
  • AI-Driven Threat Detection (Beta): Analyzes DNS queries and answers in real-time to detect and block malicious behavior.
  • Google Safe Browsing: Use Google's technology to block malware and phishing domains.
    • Caution: It wasn't designed as a DNS-level blocker and may flag legitimate CNAME domains as scams. It can take months to remove a false positive.
  • Cryptojacking Protection: Prevent unauthorized use of your devices to mine cryptocurrency.
  • DNS Rebinding Protection: Prevent attackers from taking control of local devices over the Internet by automatically blocking DNS responses containing private IP addresses.
  • IDN Homograph Attacks Protection: Block domains that impersonate other domains by misusing characters from different scripts (for example, replacing Latin "e" with Cyrillic "е").
  • Typosquatting Protection: Block domains registered by malicious actors targeting users who mistype website addresses (for example, gooogle.com instead of google.com).
  • Domain Generation Algorithms (DGAs) Protection: Block domains generated by algorithms used by malware to communicate with command and control servers.
  • Block Newly Registered Domains (NRDs): Block domains registered less than 30 days ago.
    • Caution: This may cause occasional false positives. If you plan to "set-and-forget", consider disabling this.
  • Block Dynamic DNS Hostnames: Block hostnames from DDNS services. Note that DDNS services can still access their own update APIs.
  • Block Parked Domains: Block single-page websites that often contain ads and low-value or potentially malicious content.
  • Block Top-Level Domains (TLDs): Block all domains under specific TLDs known for high malicious activity.

Recommended TLDs to block

Blocking these commonly abused TLDs offers protection without much risk to everyday browsing:

  1. .autos
  2. .best
  3. .bid
  4. .boats
  5. .boston
  6. .boutique
  7. .charity
  8. .christmas
  9. .dance
  10. .fishing
  11. .hair
  12. .haus
  13. .loan
  14. .loans
  15. .men
  16. .mom
  17. .name
  18. .review
  19. .rip
  20. .skin
  21. .support
  22. .tattoo
  23. .tokyo
  24. .voto

Best practices

  • Prevent Overblocking: Avoid blocking features that have a high rate of false positives unless your threat model requires it.
  • Grandma Test: A configuration is successful if it passes the "Grandma Test"—it should work for a typical user without constant manual intervention.

Reference