DNS Implementation: Security Considerations

For clients who want a plug and play solution, CrowdHandler provisions a CDN in front of their origin using a DNS change. This allows all traffic to be routed through our application for queueing and access control. However, the DNS implementation has additional security implications clients should understand before enabling this feature.

Isolated AWS Resources

The CloudFront distribution and related resources for the DNS implementation are deployed within CrowdHandler’s dedicated AWS account. Clients do not have direct access to configure these resources.

Data Visibility

Our Lambda@Edge functions call our API to route requests and responses but only have access to request headers, not the request body or origin response body. We have no visibility into sensitive data transmitted. However, the client is unable to independently verify this due to the isolated AWS resources.

Use of Encryption

All communication between end users, CloudFront and origin applications are encrypted in transit via TLS. CloudFront also supports field-level encryption to further protect sensitive data.

No PAN Data

Our DNS implementation does not support the transmission of personally identifiable payment information like credit card numbers. Any PAN data must be handled outside the scope of this feature so CrowdHandler remains outside the client's cardholder data environment for PCI compliance.

Shared Responsibility

While we configure and manage CloudFront, Route 53, and Lambda@Edge, the client maintains responsibility for their origin security and compliance. We recommend:

  • Enabling origin TLS and keeping certificates up to date
  • Using a "No-Bypass" header with a shared secret to prevent bypassing CrowdHandler
  • Hardening infrastructure and enabling firewalls for only necessary ports/protocols
  • Conducting regular vulnerability scans and patching origin systems
  • Meeting relevant compliance and regulatory requirements for their data/industry

CrowdHandler's DNS implementation aims to provide simple access control and distribution for clients. However, it relies on proper security practices at the origin to safeguard sensitive data and meet compliance obligations. Clients should evaluate their use of this feature to determine controls and responsibilities for their unique needs.