Revealing the Cracks in AA Services

Revealing the Cracks in AA ServicesWeb developers and service providers are often amassing and daisy chaining an array of applications, protocols, and libraries into their toolchains.Consequently, vulnerabilities, bugs, malwares, and data leakages start creeping in, often in ways one would not have initially imagined.These Achilles heels are ever more critical when precarious infrastructures and safety services depend on them.An example of these critical services in the U.S. is Alerting Authorities (AAs); jurisdictions with the designated authority to alert and warn the public when there is an impending natural or human-made disaster, threat, or dangerous or missing person.Today, there are more than 1,600 federal, state, local, tribal, and territorial alerting authorities that issue critical public alerts and warnings in their jurisdictions.Like many emergency services, AAs rely on the Internet for communications and operations.Like many public sector services, maintaining security and reliability is important, yet it is not always easy to have a dedicated team able to keep up with the rapid advances in the cybersecurity domain.For important services like AAs to operate online, one of the initial building blocks and fundamental protocols to configure and securely operate is the Domain Name Service (DNS).Known as one of the most critical protocols of the Internet and Web services, DNS enables various Web services and programs to use familiar names as a destination, which are then resolved to the corresponding IP address of destination servers.DNS security is vital to the operation of the Internet, as nearly every service, app, IoT device, and website relies on it.This includes safety services owned and managed by various government authorities around the world.DNSSEC helps in securing DNS, by associating a cryptographic signature to an existing DNS record, enabling one to verify that a DNS record comes from its authoritative name server.Along with securing DNS, Public Key Infrastructure (PKI) certificates are also used to secure a webpage or encrypt data transfer channels and files using certificates that can be verified using a publicly trusted Certificate AuthorityThe accompanying paper presents a new study, investigating AAs and their cybersafety measures, including DNS and Web PKIs.Alarmingly, the authors find that most AA services fall short of protections in these critical protocols.The study presented in this paper presents the results of investigating the websites and AA domain names to map the dependencies of services, studying DNSSEC penetration as well as domain-validation Web PKI certificates and use of restricted top-level domains (TLDs).The authors develop Assurance profiles as a technique to assess the adequacy of security implication for users.