Why Do We Need DNSSEC?
DNS is one of the basic building blocks of the Internet. Served as a phone book to the Internet, DNS translates machine-readable numerical IP addresses (e.g. 210.184.51.89) to human-readable web addresses (e.g. www.hkirc.hk). However, the DNS has a fundamental security flaw, raising both economic concerns (in terms of revenue losses, fraud and brand damage) as well as security issues for users (identity theft) and companies (traffic redirection).
Vulnerability of DNS
When a user gives a hostname, the DNS tells the computer where to send and retrieve information, yet it accepts any IP address given. This security flaw allows attackers to hijack the process of “translation” and redirect users to hijackers’ own deceptive websites.
The solution is to introduce an Internet security measure, an end-to-end deployment security protocol to secure DNS’s Internet infrastructure. With the use of DNSSEC, we can increase the security, reliability and trustworthiness of .hk domain names while ensuring Internet users are accessing the right websites.