0

My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that our customers connect to use our services.

Besides this we also have another set of tools that are used only internally by our employees (customer management software, ticket management, bi, etc). I've clustered everything inside a single subdomain internal.company.com. This means that we have domains like tickets.internal.company.com or bi.internal.company.com.

Even though we don't publicize these domains, since they all have a TLS certificate it's quite easy to find them only. As a matter of fact, search through the logs I can find lots of exploit crawlers trying to access /.env, /wp-admin and so on. We always try to keep everything up-to-date, but leaving things out in the open (specially the BI tools, since they can download lots of data) scares me.

I'm thinking about buying a new domain just for these internal tools, something that is unrelated to the name of the company. I think this would at least make it harder for a targeted attack, since the attacker would have to know this domain name (thus having someone inside the organization providing this information to him).

I could force everyone to use a VPN to connect to a local network and then provide the service there, but I'm trying to avoid the hassle of having to help every non-technical employee how to use a VPN.

Am I being too paranoid? Does having a separate domain actually helps mitigate some of the threats or it would actually make any significant difference?

PS: The internal tools range from open source projects installed on our servers to services completely developed inside the company.

2
  • The idea of hiding your admin site behind a different domain sounds like 'security by obscurity' to me. I would instead focus on making sure your existing admin site is well secured, and that you have a strong multi-factor authentication. WebAuthN and/or SSL client certificates might be part of this.
    – mti2935
    Jul 27 at 19:17
  • ... you could (and probably should) have an internal-only CA that provides certs for things like internal-only domains (this requires cert distribution, though). Which would at least "anonymize" the domains. This doesn't negate properly securing the domains otherwise, however (VPN or otherwise). Jul 30 at 6:23
2

I use DNS Host Overides on each of my Firewalls to redirect internal.company.com to a private IP.

Public: internal.company.com 1.1.1.1

Using the Firewall: internal.company.com 172.16.10.45

This would require remote workers use a VPN. Buying an un-related domain is a Security through obscurity debate.

https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html#host-overrides

1
  • Absolutely! Never directly connect internal only content to the Internet. Jul 27 at 21:44
1

Even though we don't publicize these domains, since they all have a TLS certificate it's quite easy to find them only. As a matter of fact, search through the logs I can find lots of exploit crawlers trying to access /.env, /wp-admin and so on.

It these domains, more exactly the corresponding IP address blocks are exposed to the Internet you have a segregation problem. They are supposed to be used internally by your employees. That begs the question, why are they accessible to outsiders ? Is it just because you have no VPN access set up ?

You might want to review your firewall rules. You may have a website hosted internally, you may have your own mail server. But the other machines should not be exposed without a good reason. If you have no VPN... then you know what to do. Remote users should use a VPN. Sorry for the non-technical employees, but they are already using a computer (and if they can survive Windows updates, then the VPN client is no big deal... ;-))

In fact you don't bother if other people can resolve the domain names to IP addresses. What is important is that they can't reach them.

Attackers scan for IP addresses in bulk, what you see is automated bot attacks launched on a more or less large scale. It's unlikely that you are being targeted specifically (although that remains possible if you have valuable IP and know-how). They will find you, regardless of what domain name or IP address you use.

1

I could force everyone to use a VPN

If you can, then do it.

This sounds to me like the best was of achieving your goal of allowing only internal company employees access to the internal company tools/URLs.

Does having a separate domain actually helps mitigate some of the threats

It mitigates some threats. For example, direct subdomain enumeration using an automated subdomain guessing tool like fierce.

or it would actually make any significant difference?

This depends on what you consider significant, but it seems to me that there will likely not be much significant difference. For example, you are probably still going to see a bunch of malicious access attempts regardless of what the domain name is.

Conclusion: Don't bother with the new domain name. Just make your users use the VPN to connect to internal resources. (This way the internal resources are not exposed to the external people who should not see them).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.