As promised, the latest version of Windows Server 2008 R2 is the first Windows Server to fully support DNSSEC. DNSSEC is a security protocol that helps to verify that a Web address hasn't been hacked and redirected to a pretender. Better still, Windows 7 also supports DNSSEC, which Microsoft claims is a first among client operating systems.
DNSSEC had been bandied about the IETF for years but came into the public eye in July, 2008, when security researcher Dan Kaminsky disclosed a serious flaw in the DNS that makes it possible for hackers to launch DNS cache poisoning attacks.
In response to that flaw, for the first time, vendors such as Microsoft, Sun and Cisco banded together together to close the flaw. But even a year after that historic patch security experts said that DNS still needed to be more secure. DNSSEC applies the old public/private key cryptography trick to solve the DNS problem. Obviously, issues abound with rolling out such a fix, among them a lack of servers and clients that supported DNSSEC. But progress is being made. ICANN is expected to start rolling out changes in January 2010 to the root zone that will let DNSSEC be applied, even in developing areas of the world, such as the countries of Africa, source of so much Nigerian spam, reports Computerworld.
The previous version of Windows Server 2008 did artistically support this security protocol, but WS2008 R2 is the first Microsoft server operating system to be fully compliant the current standards (The IETF's RFC 4033, RFC 4034, and RFC 4035).
With DNSSEC support, network administrators can use a Windows Server machine to generate keys and to validate that file being requested by servers over the Web are being sent by a trusted source. Similarly, the Windows 7 client includes what it needs to validate that it is communicating with a server using DNSSEC and that said server has completed a validation process. A TechNet article from May that lists all of the security features in Windows 7 puts it this way:
"Windows Server 2008 R2 and Windows 7 introduce support for DNSSEC as per the current standards (RFC 4033, RFC 4034, and RFC 4035). Windows Server 2008 R2 will allow the DNS Server to provide origin authority and data integrity artifacts. Basically, a server will be able to attach digital signatures to DNS data in responses as well as validate data received from other DNS servers.
"Windows 7 is the first client operating system to include the necessary pieces to allow the client to verify that it is communicating securely with a DNS server and verify that the server has performed DNSSEC validation on its behalf. This technology is currently being tested to ensure the maximum compatibility with current Internet infrastructure and aims to play a continuing role in securing DNS data in the future."
If all this sounds complicated that's because it is. To that end last week Microsoft released a Windows Server 2008 R2 deployment guide. This 85 page how-to guide is offers a nice overview of the entire process of setting up DNSSEC on Windows Server. The plot of this novella of a guide may not be gripping, but better Web security does promise a happy ending.
Like this post? Check out these others.
- Windows Server 2008 R2: Security Changes and Additions Part III
- AppLocker in Server 2008 R2
- Microsoft Linux: Why one free software advocate wants it
- Are you ready for Windows 7 and Windows Server 2008 R2?
- Torvalds offers a thumbs-up to Windows 7
- Exchange 2010 Prerequisites Made Easy
- Microsoft, Dell, Spectrum Bridge launch first public white spaces network
- 7 tools for Windows 7 rollouts
Plus, visit the Microsoft Subnet web site for more news, blogs, podcasts. Subscribe to all Microsoft Subnet bloggers. Sign up for the bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)
Follow All Microsoft Subnet bloggers on Twitter
Follow Julie Bort on Twitter
The Microsoft Subnet blog is the official blog of the Network World's Microsoft Subnet community, and is written by Online Community editor Julie Bort. Microsoft Subnet is the independent voice of Microsoft customers and is your gateway to daily Microsoft news, blogs, opinion, books, prize giveaways and more. Visit the Microsoft Subnet index page daily, and while you are there, subscribe to the Microsoft newsletter. The newsletter includes news generated by the Microsoft Subnet community as well as other Microsoft news stories published by Network World.
The Leader in Network Knowledge
Post new comment