Uncover How to Set DNS Security in SECUI

DNS Security on SECUI is a network security feature that prevents access to malicious domains, such as those used for trojans, malware, or DNS tunneling. This feature works by detecting and blocking domains listed in the SECUI threat database.

By enabling DNS Security, you can prevent users within your network from accessing harmful websites that could become entry points for cyberattacks.

Figure 0.1 DNS Security Topology on a SECUI Network

1. Login to SECUI

Before configuring, ensure you're logged in with an administrator account.

Figure 1.1 SECUI Login Page

2. Enable DNS Security

The first step is to activate DNS Security from the general settings menu.

• Navigate to Object > Security Profile > DNS Security > DNS Security Common Settings

• Enable the "DNS Security" option

Figure 2.2 DNS Security Activation Setting

3. Create a DNS Security Profile

Once DNS Security is enabled, you need to create a DNS Security profile to define filtering policies.

• Go to DNS Security Profile

• Click Add +

Figure 3.2 Adding a DNS Security Profile

• Customize the DNS Security Profile and make sure Enable is checked

Each DNS Security profile can be adjusted with the following options:

• Whitelist: A list of allowed domains, even if flagged as threats.

Figure 3.3 Domain Whitelist Menu

• Blacklist: A manual list of domains you want to block.

Figure 3.4 Domain Blacklist Menu

• DNS Tunneling Check: Detects DNS tunneling techniques often used to bypass filters or communicate with C2 servers.

Figure 3.5 DNS Tunneling Detection Option

This feature is useful in scenarios such as:

• Your company’s domain is mistakenly blacklisted
• A high-threat-score domain not yet in the threat database
• Users utilizing third-party DNS or proxies

Conclusion

DNS Security on SECUI adds an extra layer of protection by automatically blocking access to malicious domains. By following this guide, you can easily enable and manage DNS Security features to enhance your network's cybersecurity posture.

Ensure your DNS profile is applied to the firewall policy and monitor logs regularly to maintain effective protection.

Need more help or want to speak with a technical expert? Contact us here!