The NSA is piloting a secure DNS service for the defense industrial base

In an effort to better protect the U.S. defense industrial base from malware-based threats, the National Security Agency has launched a pilot program on securing Domain Name System use for U.S. defense contractors.

The NSA’s cybersecurity directorate has been working on the pilot, called secure DNS, for six weeks, the directorate’s chief, Anne Neuberger, said during a virtual event Thursday.

“Our analysis highlighted that using secure DNS would reduce the ability for 92% of malware attacks … from a command and control perspective, deploying malware on a given network,” Neuberger said.

The NSA is collaborating with the Defense Digital Service on the pilot, Defense Digital Service Director Brett Goldstein told CyberScoop.

DNS, is the protocol by which IP addresses are translated to access specific websites with their more familiar domain names and URLs. Attackers have long exploited DNS to deliver malware to targets or run credential-stealing campaigns, according to security researchers and the Department of Homeland Security.

Since the NSA Cybersecurity Directorate was established last fall, shoring up the cybersecurity of the defense industrial base (DIB) and weapons technologies has been one of its top objectives.

The NSA pilot also comes amid a broader push from the U.S. government to bolster government defenses against threat actors’ efforts to exploit DNS. DHS‘s cybersecurity agency also recently announced that it is working to rollout a DNS resolver service to interfere with threat actors’ malware, ransomware, or botnet campaigns against U.S. government agencies.

The NSA’s secure DNS pilot is targeted at providing secure services to small- and medium-sized companies working on Department of Defense weapons technologies, according to Neuberger.

“This is a model that can help kind of jumpstart that security particularly for smaller- and medium- sized companies that may not have the ability to invest the resources or [have] the right skilled personnel,” Neuberger said. “We know they’re targets because they’re building weapons technology for the department.”

Neuberger said ideally the pilot will help the NSA establish a baseline for other companies to offer secure DNS services to defense contractors in the future.

“The results of the pilot have been very, very successful,” Neuberger said. “Our goal would be … let’s document and standardize what the secure DNS service looks like and then enable any number of companies who can meet that standard to offer that service with the goal of really encouraging small- and medium-sized defense DIB companies” to focus on secure DNS use.