72 definitions associated with Security.
72 matching terms
Page 1 of 3A rule set that permits or denies operations based on attributes such as source address, identity, network, or transaction type. DNS and DHCP ACLs commonly control recursion, zone transfers, updates, queries, and administrative access.
Read definitionA policy controlling which clients may ask a DNS server questions. It is commonly enforced globally, per view, or per zone.
Read definitionA policy controlling which clients may use a resolver to perform recursive resolution. Restricting recursion prevents an internal resolver from becoming an open resolver.
Read definitionA policy controlling which systems may request AXFR or IXFR zone transfers. Transfers should normally be limited to designated secondaries and management systems.
Read definitionCommon shorthand for BloxOne Threat Defense, Infoblox's protective DNS and DNS security service. It combines policy, threat intelligence, reporting, and cloud or hybrid enforcement components.
Read definitionA configuration that intentionally returns no useful result or directs selected names to a non-routable or controlled destination. The term can refer to policy blocking, sinkholing, or routing a DNS service address to discard traffic.
Read definitionA list of domains, addresses, clients, or indicators for which an action such as deny, redirect, log, or quarantine is applied. Modern documentation often uses blocklist instead of blacklist.
Read definitionAn Infoblox DNS security platform that applies protective-DNS policy, threat intelligence, analytics, and ecosystem integrations. It is often abbreviated B1TD.
Read definitionThe insertion of false DNS data into a resolver cache so future clients receive an attacker-chosen answer. Defenses include strong transaction matching, source-port randomization, DNSSEC validation, cookies, and hardened bailiwick processing.
Read definitionA lightweight DNS transaction token carried in an EDNS option to help a server verify that a client can receive traffic at its claimed address. DNS Cookies can reduce spoofed-query abuse and improve transaction matching.
Read definitionDNS-Based Authentication of Named Entities, a family of mechanisms that uses DNSSEC-protected records to associate services with certificates or public keys. TLSA is the best-known record used by DANE.
Read definitionA DNS record that points to a resource that no longer exists or is no longer controlled by the intended owner. If another party can claim the target service, the condition can enable subdomain takeover.
Read definitionIdentification or classification of a client device based on the DHCP options it requests, sends, or orders. Fingerprints can support inventory, policy, NAC, and anomaly detection, but are not a strong identity mechanism.
Read definitionA Layer 2 security feature that classifies switch ports as trusted or untrusted, permits legitimate DHCP server traffic only from trusted paths, and builds a binding table from observed leases. The table can support Dynamic ARP Inspection and IP Source Guard.
Read definitionAn attack or fault in which many fake client identities consume the available address pool, preventing legitimate clients from obtaining leases. Rate limits, DHCP snooping, port security, and monitoring help mitigate it.
Read definitionA denial-of-service technique in which an attacker sends small spoofed queries that trigger larger DNS responses toward a victim. Open recursion, large UDP responses, DNSSEC data, and ANY behavior can increase the amplification factor.
Read definitionTechniques that infer whether a resolver recently looked up a name by observing its cache behavior or TTL. Restricting recursion and minimizing information leakage can reduce exposure.
Read definitionAn EDNS option that carries client and server cookies to improve transaction assurance and reduce off-path spoofing and reflection abuse without establishing a full session.
Read definitionA policy enforcement layer that blocks, redirects, or otherwise controls DNS resolution based on domain intelligence, client identity, category, or behavior. RPZ is a common standards-based policy distribution mechanism.
Read definitionUnauthorized alteration or interception of DNS behavior so users receive attacker-selected or policy-selected results. It can occur at registrars, authoritative servers, resolvers, endpoints, routers, or network interception points.
Read definitionAn attack in which a domain's answers change so browser-originated traffic is redirected from an attacker-controlled host to an internal or local address. Resolver protections can block suspicious private or loopback answers for external names.
Read definitionAn authoritative-server defense that limits repeated similar responses, especially to spoofable UDP queries, to reduce participation in reflection attacks. Implementations usually allow some responses and may trigger truncation.
Read definitionThe malicious creation of many subdomains beneath a legitimately registered domain, often after account compromise, to host phishing, malware, or command-and-control infrastructure. The parent domain can initially appear reputable.
Read definitionA controlled DNS response that directs prohibited or suspicious names to an analysis, notification, or non-routable destination. Sinkholes can disrupt malware while generating telemetry about affected clients.
Read definition