This tutorial focuses on how network operators and enterprises can leverage DNS Response Policy Zones (RPZ) to detect and mitigate threats effectively.
Participants will gain insights into the fundamentals of DNS and RPZ, learn how to configure and manage RPZ for dynamic threat protection and explore real-world use cases where DNS-based defenses have thwarted malicious activities.
The tutorial will cover key topics such as how threat actors use and abuse the DNS, identify malicious domains, block phishing attempts, block DNS queries to command & control (C2) servers and integrate RPZ into existing security frameworks.
Designed for network operators, network administrators, and cybersecurity practitioners, this hands-on tutorial combines technical expertise with practical exercises to equip attendees with the skills needed to harness the full potential of DNS as a robust layer of defense.
By the end of the session, participants will have a comprehensive understanding of how to transform DNS from a passive infrastructure component into an active security mechanism.
Requirements:
Target Audience: Network administrators, security engineers, and tech folks at ISPs.
Pre-requisites:
- Basic knowledge of DNS.
- Familiarity with Linux and networking tools.
- Participants are required to bring a laptop equipped with WSL (Windows Subsystem for Linux), or a Linux/Unix command line environment, with administrator privileges enabled.