New research has revealed that DNS attacks are costing businesses more than $1 million a year in lost business and service downtime.

For years, DNS has silently and peacefully served internet needs, but it's mostly been thought of as a trivial protocol requiring very basic configuration and monitoring. Despite its criticality, this service has never really been considered as a potential security issue, mostly because common usage leads people to believe it is a trivial protocol requiring very basic confguration and monitoring.

But while DNS may have been safe and apparently secure for the last twenty years, because of its complexity and evolving role in the IT industry it has become a powerful attack vector, with 91% of malware using the DNS protocol.

> See also: Denying the deniers: how to effectively tackle DDoS attacks

According to the new study by EfficientIP, the top three DNS attacks that have the largest impact on an organisation are Distributed Denial of Service (DDoS attacks, Zero-Day vulnerabilities and data exfiltration. These types of attacks are the main cause of business outage and data theft.

But despite 74% being victims of DNS attacks, 25% of businesses still aren't implementing any kind of basic security software. EfficientIP's experts warn that existing DNS defenses are outdated and no longer work.

> See also: Back to basics: how to get a security strategy refresh

Until now, the approach to IT Security has been one that has downplayed the risk of DNS threats, bundling them in with a wide selection of diferent network threats that can be protected using traditional security tools and techniques.

It is an approach that threatens DNS security by overcomplicating architectures, adding slow and inappropriate layers of defence.

While firewalls can protect on a basic level, on their own they;re not designed to deal with high bandwidth DDoS attacks, or detect DNS tunnelling attempts (the majority of DDoS attacks are now over 1Gbps), and most businesses still rely on the ‘out-of-the-box’ non-secure DNS servers offered by Microsoft or Linux servers.

'The report has highlighted that despite the massive increase in cyber attacks, companies and their IT departments still don’t fully appreciate the risks from DNS-based attacks,' said David Williamson, EfficientIP CEO.

'In just under two years GDPR will come into effect and companies will be held responsible for all security breaches and could face major fines. It’s crucial for all businesses to start taking DNS security seriously.'