<p>
<img src="http://www.networkworld.com/graphics/i/logo.gif" alt="From Network World:" width="218" border="0" height="40"><br>
<img src="http://www.networkworld.com/gif/4shim.gif" alt="" width="2" height="5"><br>
<font size="-1">This story appeared on Network World at<br>
<a href="http://www.networkworld.com/news/2009/060209-public-interest-registry-org.html">http://www.networkworld.com/news/2009/060209-public-interest-registry-org.html</a></font></p><p>
</p><h1> Security tightened for .org
</h1>
<div id="article_subtitle">Public Interest Registry runs largest-ever domain to adopt DNS security extensions</div>
<div id="article_author">
By
<a href="http://www.networkworld.com/Home/cduffy%20marsan.html">Carolyn Duffy Marsan</a>
,
Network World
, 06/02/2009
</div>
<div id="article_copy">
<div id="imu" style="float: right;"><font size="1">
Sponsored by:</font><br><span style="border-left: 0pt solid black; z-index: 999999; position: relative; vertical-align: top;" id="arm_positioningNode_2288ae1cc6634530928a7320c4df4d01f5f72c22e0374a7e849e9d544e482b1c"><span style="overflow: hidden; position: absolute; z-index: 999998; visibility: hidden; top: -293.5px; left: -562px; height: 500px; width: 550px;" id="OuterOrange2288ae1cc6634530928a7320c4df4d01f5f72c22e0374a7e849e9d544e482b1c"></span></span></div>
<p class="first">The Public Interest Registry will announce today that it has begun cryptographically signing the .org top-level domain using
DNS security extensions known as <a href="https://www.networkworld.com/community/taxonomy/term/18392">DNSSEC</a>.
</p>
<p>DNSSEC is an emerging standard that prevents spoofing attacks by letting Web sites verify their domain names and corresponding
IP addresses using digital signatures and public-key encryption.
</p>
<p>DNSSEC is viewed as the best way to bolster the DNS against vulnerabilities including the <a href="http://www.networkworld.com/news/2008/070808-dns-flaw-disrupts-internet.html">Kaminsky Bug</a>, a DNS flaw discovered last summer that allows a hacker to redirect traffic from a legitimate Web site to a fake one without
the user knowing.
</p>
<p>"DNSSEC is a needed infrastructure upgrade," says Alexa Raad, CEO of the Public Interest Registry (PIR). "It has passed the
threshold of being a theoretical opportunity to being a practical necessity. The question then becomes: How do we make it
work?"
</p>
<p>With 7.5 million registered names, .org is the largest domain to deploy DNSSEC.</p>
<p>Current DNSSEC users include country code domains run by Sweden, Puerto Rico, Bulgaria, Brazil and the Czech Republic.</p>
<p>"Us signing the zone is a very important step, but it's also a symbolic step," Raad says. "A large [generic top-level domain]
has now signed their zone. It will signal to all the other players in the chain that it is time to work very seriously on
the software and applications to make DNSSEC viable in the near future."
</p>
<p>PIR announced plans to deploy DNSSEC last June, and in December it vowed to share its experiences with members of the <a href="http://www.networkworld.com/news/2008/120908-dns-security.html?page=1">DNSSEC Industry Coalition</a>. The coalition includes leading domain name registries such as VeriSign, NeuStar and Afilias as well as DNS software providers
NLnet Labs, Secure64 and InfoBlox.
</p>
<p>Raad says it's important for PIR to share its experiences with DNSSEC because "this is not something that one actor can take
on. It does take a village, to borrow a phrase, to do it properly."
</p>
<p>One recommendation that PIR is making to the industry is that DNSSEC deployments use the newer NSEC3 algorithm rather than
the older NSEC, which is less secure and requires <a href="http://www.dnssecreport.com/DNSSECReport/Content.aspx?SID=8">more processing</a>.
</p>
<p>PIR also is prompting the DNSSEC Industry Coalition to develop operational procedures such as how to transfer domains from
a register that supports DNSSEC to one that doesn't.
</p>
<p>"We take this as an immense responsibility," Raad says. "We want to make sure that prudence and caution take way over haste"
with our DNSSEC deployment.
</p>
<p>On June 2, PIR will announce that it is signing the .org domain with NSEC3 and that it has begun testing DNSSEC with a handful
of registrars using first fake and than real .org names. PIR plans to keep expanding its testing over the next few months
until the registry is ready to support DNSSEC for all .org domain name operators.
</p>
<p>Raad says she expects full-blown DNSSEC deployment on the .org domain in 2010.</p>
<p>"I don't expect it to be this calendar year," she says. "This is about learning and sharing our learning with industry."</p>
<p>The good news for .org domain name holders is that PIR's DNSSEC testing and deployment won't affect their day-to-day operations.</p>
<p>"It's important to note that .org domain holders don't have to do anything," Raad says. "Their domain names will function
as usual."
</p>
<p>Raad says enterprise network managers should start asking their ISPs, domain name registrars and DNS vendors what they are
doing to support DNSSEC.
</p>
<p>First envisioned in 1995, DNSSEC efforts have ramped up dramatically since last summer when the Kaminsky bug was discovered.</p>
<p>The U.S. federal government is deploying DNSSEC across its <a href="http://www.networkworld.com/news/2009/020909-dns-security-deadline.html?page=1">.gov domain</a> this year, with plans for all sub-domains to be signed by the end of 2009.
</p>
<p>VeriSign has committed to deploying DNSSEC across .<a href="http://www.networkworld.com/news/2009/022409-verisign-dns-security.html?page=1">com and .net</a> by 2011.
</p>
<p>But the Internet engineering community is waiting for the U.S. federal government to deploy DNSSEC across the <a href="http://www.networkworld.com/news/2008/112508-dns-root.html">root zone</a>.
</p>
<p>More DNSSEC news is anticipated next week because the DNSSEC Industry Coalition is hosting a <a href="http://pir.org/index.php?db=content/News&tbl=Press&id=24">symposium</a> in Washington D.C. June 11 and 12 to discuss DNSSEC deployment issues including how best to sign the root zone.
</p>
<p>
<font size="-1">All contents copyright 1995-2009 Network World, Inc. <a href="http://www.networkworld.com/">http://www.networkworld.com</a></font>
</p></div>