Heimdal DNS Security - Product Demo

Summary

This video highlights the advanced capabilities of the Heimdall DNS Security product, offering both endpoint and network versions for optimal protection. Powered by predictive DNS technology and AI, it accurately identifies malicious domains with a 97% accuracy rate. The system also includes machine learning-driven vector and detection technologies to analyze traffic patterns. Key features include custom blocking, full DNS and HTTPs traffic logging, and host intrusion prevention. The demo illustrates the real-time detection of a potential cyberattack, showcasing tools like VirusTotal for further analysis. This comprehensive security solution strengthens your defenses against sophisticated threats like ransomware.

Takeaways

• 😀 Endpoint DNS security requires an agent on the computer, while the network version does not.
• 😀 Combining both the endpoint and network versions of DNS security provides ultimate protection.
• 😀 Dark Layer Guard, powered by predictive DNS technology, leverages AI to analyze domain characteristics and predict malicious intent with 97%+ accuracy.
• 😀 Vector and detection technology utilizes machine learning algorithms to detect subtle malicious communication patterns.
• 😀 The DNS security product offers custom blocking, custom allowing, and customizable blocking pages.
• 😀 Full DNS traffic, including HTTP and HTTPS traffic, is logged to enhance security.
• 😀 Host intrusion prevention and detection, forensics capabilities, and more are included in the product.
• 😀 The dangers of DNS are highlighted through practical examples, such as connecting to multiple hidden domains while visiting a trusted website.
• 😀 Malicious connections can occur in the background without the user’s awareness, making DNS security essential.
• 😀 The Heimdall console allows easy identification of suspicious connections, displaying real-time data and threat assessments for each machine.
• 😀 Virus Total integration enables quick analysis of suspicious domains and files, identifying potentially harmful threats like the WannaCry ransomware.

Q & A

What are the two versions of the DN security product mentioned in the script?

The two versions of the DN security product are the endpoint DNS security, which requires an agent on the computer, and the network version, which does not require any agent.

How does the predictive DNS technology contribute to the DN security product?

The predictive DNS technology, powered by AI, analyzes all characteristics of a domain and determines with over 97% accuracy whether it is used or will be used for malware or malicious purposes.

What is the role of the vector and detection technology in the DN security product?

The vector and detection technology uses machine learning algorithms to continuously analyze traffic and detect subtle patterns of malicious communication, enhancing the security of the DNS product.

What kind of DNS traffic does the DN security product log?

The DN security product logs not just DNS traffic but also HTTP and HTTPS traffic, ensuring comprehensive monitoring.

What additional functionalities are offered by the DN security product besides security?

The DN security product offers features such as custom blocking, custom allowing, a custom blocking page, and full logging of DNS traffic.

How does the DN security product assist in identifying malicious behavior during DNS connections?

It provides an easy-to-use interface that flags machines presenting higher risks and offers forensic capabilities to trace back to suspicious processes and connections.

What does the forensic mode allow you to investigate?

The forensic mode allows you to investigate the IP behind suspicious connections, the process responsible for initiating the connection, and to analyze this further using tools like the VirusTotal connector.

What role does VirusTotal play in the DN security product's detection system?

VirusTotal helps analyze suspicious files by comparing them with results from over 90 security vendors, showing whether a particular file or connection is dangerous.

What is the significance of the WanaCry ransomware in the context of the script?

The script demonstrates how the DN security product detected a WanaCry distribution domain, showing that without proper DNS security, malware like WanaCry could infect the system, encrypt data, or disrupt networks.

What additional feature related to DNS traffic does the DN security product offer?

The DN security product offers DNS over HTTPS (DoH) capability, which enhances privacy by encrypting DNS requests, and also includes category blocking, which allows for blocking certain content at specific times.