Infoblox Security Ecosystem Integration

Summary

This video explains how InfoBlocks DNS security platform enhances your organization's security posture by improving incident detection and response capabilities. By integrating with various security products like SIEM, firewalls, and vulnerability management tools, InfoBlocks proactively shares DNS data to enable faster threat remediation. The platform helps prevent DNS-based attacks such as command and control communications, phishing, and data exfiltration, reducing the risk of lateral movement. Through automation and integration, it significantly lowers Mean Time to Respond (MTTR), improving overall cybersecurity efficiency and return on investment.

Takeaways

• 😀 InfoBlocks provides on-premises and SaaS-based DNS security to improve cybersecurity posture.
• 😀 Integration with security platforms like SIEM, ITSM, firewalls, and SOAR tools enhances incident detection and response.
• 😀 DNS lookups are unprotected, making them vulnerable to threats like data exfiltration and command-and-control attacks.
• 😀 InfoBlocks proactively shares DNS data with security tools to enable faster remediation through automation.
• 😀 The DNS protocol is often ignored by firewalls, leaving networks exposed to lateral movement and attacks.
• 😀 InfoBlocks helps improve MTTR (Mean Time to Resolution) by automating incident response tasks and integrating with security products.
• 😀 Automated responses include logging tickets in ITSM, adding infected IPs to firewalls, and sending logs to SIEM platforms.
• 😀 DNS-based threats, such as malicious web links and phishing attacks, can be blocked by InfoBlocks at the DNS resolution stage.
• 😀 InfoBlocks enables seamless integrations across different security tools, reducing complexity and increasing ROI on existing investments.
• 😀 The platform provides extended DNS security across corporate environments, remote sites, and roaming users, ensuring comprehensive protection.
• 😀 Automation of threat detection and response ensures faster remediation, improving overall security efficiency.

Q & A

What is the main focus of the Infoblox platform in the context of cybersecurity?

The Infoblox platform focuses on DNS security and ecosystem integration. It helps improve an organization's security posture by accelerating incident detection and response capabilities, which enhances Mean Time to Recovery (MTTR).

How does Infoblox integrate with other security products?

Infoblox integrates with a range of ecosystem security products such as ITSM platforms like ServiceNow, SIEM solutions like Splunk and IBM QRadar, next-generation firewalls like Palo Alto, vulnerability management tools like Qualys and Rapid7, and other platforms like Cisco ICE, Aruba ClearPass, and Palo Alto Phantom.

What is the role of DNS security in improving cybersecurity?

DNS security protects against DNS-based threats by preventing unauthorized DNS lookups, which could be exploited for data exfiltration or establishing command-and-control channels. It helps detect and block threats early, thereby reducing the risk of lateral movement and network-wide infection.

Why are DNS lookups considered unprotected, and what risk does this pose?

DNS lookups are typically unprotected because most firewalls do not inspect DNS traffic, viewing it as a critical protocol for internet functioning. This leaves users vulnerable to attacks like DNS exfiltration and command-and-control communication, which can bypass traditional security defenses.

What can happen if DNS-based threats are not detected and responded to in time?

If DNS-based threats are not detected and responded to promptly, there is a high probability of lateral movement within the network. This can lead to network-wide infections and increased risk to the organization's overall security.

Can Infoblox help improve MTTR, and how?

Yes, Infoblox can improve MTTR by blocking DNS resolution for threats such as malicious C2 servers and phishing links, and then sharing contextual data with other security tools. This allows for faster remediation through automated tasks like logging tickets, correlating event data, blocking IP addresses, and running vulnerability scans.

What are some of the automated tasks Infoblox helps with during an incident response?

Infoblox helps with tasks like logging an incident ticket in ITSM systems, sending event logs to SIEM platforms, blocking infected IP addresses via firewall policies, initiating vulnerability scans, and even quarantining users on the network through integration with other security platforms.

How does Infoblox's integration with ecosystem partners benefit security operations?

The integration with ecosystem partners allows for faster incident response through automation. Tasks like ticketing, event logging, threat analysis, and remediation can be executed quickly and accurately, enhancing operational efficiency and reducing the overall time needed to respond to threats.

What value does Infoblox's secure DNS add to an organization's cybersecurity posture?

Infoblox's secure DNS provides several benefits, including threat containment by blocking threats early, extended protection across the entire organization (corporate, remote, and roaming users), reduced complexity through automated integration, and reduced MTTR due to efficient incident response capabilities.

What is the key difference between Infoblox's DNS security and traditional firewall protection?

Traditional firewalls do not inspect DNS traffic as they consider it necessary for internet connectivity. In contrast, Infoblox's DNS security inspects DNS requests, allowing it to block malicious communications that firewalls would otherwise overlook, preventing threats before they escalate.