<html><head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body
bgcolor="#FFFFFF" text="#000000">
I wanted to make sure you were all aware of several notices issued which
came just before and after the root key change over for DNS. Bad actors
with access to the older private key root (if compromised) may have
been motivated to strike before the key change over.<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.cyberscoop.com/dhs-dns-directive-government-shutdown/">https://www.cyberscoop.com/dhs-dns-directive-government-shutdown/</a><br>
<br>
This alert went out the day before change over on January 10th, 2019.
<a class="moz-txt-link-freetext" href="https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign">https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign</a><br>
<br>
This alert on January 22nd, 2019 <a class="moz-txt-link-freetext" href="https://cyber.dhs.gov/ed/19-01/">https://cyber.dhs.gov/ed/19-01/</a><br>
<br>
This alert was issued yesterday
<a class="moz-txt-link-freetext" href="https://www.us-cert.gov/ncas/alerts/AA19-024A">https://www.us-cert.gov/ncas/alerts/AA19-024A</a><br>
<br>
The timing of this change over taking place roughly 2+ weeks after the
U.S. Government Shutdown is a little unfortunate, since the switch over
date may have encouraged attacks before the old key was revoked. I do
think the re-key is a good idea, and agree with Tony Finch on the
concept of <br>
<pre style="white-space: pre-wrap; color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;">"[I favour annual rollovers, with keys generated and promulgated out
of band a few years in advance, and at most two KSKs in the root zone at
any time.]"</pre>
I welcome any comments.<br>
<br>
<div class="moz-signature">Lee Neubecker, CISSP<br>
President & CEO<br>
GreatLakesForensics.com<br>
<br>
65 W. Jackson Blvd., Suite 101<br>
Chicago, IL 60604<br>
Toll Free/Fax: 888-503-0665<br>
<a class="moz-txt-link-freetext" href="https://greatlakesforensics.com">https://greatlakesforensics.com</a><br>
<br>
Computer Forensics · Cyber Security Readiness & Response · Online
Identity Investigations<br>
Check out my security blog at <a class="moz-txt-link-freetext" href="https://leeneubecker.com">https://leeneubecker.com</a></div>
</body>
</html>