How Aspen's DNS services became more secure, reliable and cheaper
Connecting state and local government leaders
Outsourcing Domain Name Services and Web policy enforcement to OpenDNS saves the Colorado city and county money while improving security.
When Aspen, Colo., outsourced Domain Name Services for its network to a cloud-based platform offered by OpenDNS, it not only improved reliability of the service but also enabled better security as well by letting the company handle enforcement of Web policy.
The move began about five years ago when the city, which also provides IT services for the surrounding Pitkin County, began looking for an alternative to its existing DNS provider, said John Sobieralski, network coordinator for the city and county.
“We were having trouble with our ISP’s name servers going down,” Sobieralski said. “We wanted a more reliable service than they offered.”
OpenDNS provided the reliability, and DNS requests from the Aspen network now are directed to that platform. Since the city moved earlier this year to the company’s Enterprise Insights service, which also includes site blocking and policy enforcement, browser infections have essentially disappeared within its network. OpenDNS is not a complete enterprise security solution, Sobieralski said. “It is one layer of security.” But it has saved money and freed up manpower while improving security.
OpenDNS provides what it calls an infrastructure security platform, hosted in 20 data centers located around the world. Customers’ DNS requests are pointed at the platform for resolution, and at the same time security and corporate policies can be enforced to filter content, services and malicious sites.
The number of customers enables the company to gather intelligence about bad actors on the Internet to create a dynamic picture of malicious activity that can be applied to security policies. The company claims to support 50 million users and process 50 billion DNS requests at day, giving it a view into a significant percentage of Internet traffic.
Activity is analyzed and scored to identify domains that are malicious or suspicious, said Brian Hartvigsen, senior support manager at OpenDNS. Dynamic lists of sites are maintained, and their scores are used to categorize activity so that the appropriate level of enforcement can be employed for each user. Content and services also can be filtered according to customer policy. When the service is integrated with Microsoft’s Active Directory, granular policies can be applied for individuals and workgroups.
With just 6,658 permanent residents, Aspen, on the Western slope of the Rockies, is the 53rd largest city in Colorado. It is the seat of Pitkin County, and its networks are tightly integrated with the county’s, Sobieralski said. The combined networks have about 500 users distributed over 32 locations, most connected by a fiber backbone.
Moving to a new DNS provider took care of the reliability issue, but the city began having problems with the appliance it was using to filter malware and block websites. “It wasn’t doing a very good job,” Sobieralski said, and it was expensive. It was replaced by the Enterprise Insights service earlier this year at a considerable savings. “It was costing us more in maintenance for the appliance than the entire OpenDNS service.”
Enterprise Insights also provides Web-based visibility for network managers to manage activity, and it also can identify botnet communications and block outgoing traffic to command and control servers. Infected computers within the network can be identified this way.
Customized policies are built from a collection of 58 categories of online content, identified by OpenDNS, and eight security categories. Enforcement is not black and white, but can be applied through Active Directory based on the needs of individual users and workgroups — and also selectively within each category. Aspen blocks access to most online gambling sites, for instance, but allows access to the Colorado state lottery site, accepting the fact that workers are going to want to check their lottery numbers while at work.
In the months the OpenDNS security service has been in place its filtering appears to be accurate, Sobieralski said. The low rate of browser infections since using the service indicates a low level of false negatives in identifying malicious sites. “As for false positives, we rarely get those,” he said.