1. Domain Name Service (DNS) Network Registry
Rob Bandler & Laurie Collinsworth
4/19/2016

2. Agenda Introductions Service Description Value Proposition Metrics
Cost
Security
More information
Q&A

3. Introductions
Service owners: DNS: Laurie Collinsworth Network Registry: Rob Bandler
Service managers: DNS: Eric Cronise Network Registry: Laurie Collinsworth
Other service delivery team members:
Eng: Jim Yang/ John Wobus/ Dean Eckstrom
Ops: Jenny Signor / Leisha Redfield
IT Communications, Knowledge Mgmt & Training
IT Support Desk

4. Service Description Service name: Domain Name Service Product(s):
Domain Name Request/Registry
Network Registry
DNS - Domain Name Service
DHCP - Dynamic Host Configuration Protocol
NTP - Network Time Protocol
DNSDB - Network administration tools
SafeDNS - Security redirections
NUBB - Network Usage-Based Billing
Brief text description: Cornell's Domain Name Service supports the cornell.edu name space, network administration, policy compliance and security of Cornell networks, as well as query lookups for DNS names throughout the world. The key set of data is:
host name (sf-infra069.cit.cornell.edu)
host network address ( )
host hardware address (00:1A:1E:C0:4F:EC)
host owner / NetID (abc123)

5. Service Description Available to: No Fee Service Service tier: Zero
Faculty, Staff, TSPs, Students, Alumni, Guests
No Fee Service
Service tier: Zero

6. Value Proposition Value proposition Customer impact Key benefits
Standard DNS/DHCP performance and protected data/response across all Cornell networks and user devices.
Supports compliance with University Policy
Protects Cornell’s IP and DNS name space (reputation)
Customer impact
Ubiquitous configuration and results
Key benefits
Cost savings by leveraging central staff & support
Monitored, securely patched, redundant, on/off site
Distributed access for >600 Network Administrators
Self-serve registration and deployment of user devices
Inventory of users and devices for network administrators

7. Supports compliance with University Policy
5.4.1 Security of Information Technology Resources
5.4.2 Reporting Electronic Security Incidents
5.6 Recording and Registration of Domain Names
5.7 Network Registry
5.9 Privacy of the Network

8. Metrics FY16 Q3 FY 16 Q3 Metrics Count as of 3/31/16
Network Administrators
698
Domains
1,268
Networks
2416
DHCP pools
1101
DNS hosts
352,747
Total DNS queries: 1/1/16 – 3/31/16
~27 billion

9. Metrics FY16 Q3 FY 16 Q3 Metrics Count as of 3/31/2016
Registered devices
212,922
Unique registrants
62,594
Network Registry Compliance
75%
Network Quarantine incidents
1/1/16 – 3/31/16
198
Safe DNS Redirections
13,841,409
Phishing Site Redirections
9,423,090

10. Annual cost of DNS & Network Registry Services
Cost to deliver the service:
Fee for service: None
FY 16 Annual Cost
$395,420
Hardware & Software
$32,748
Labor
$326,725
Staff Support
$17,974
Administrative Overhead
FY 16 Unit cost/year
per DNS host
$1.12
per Domain
$316.59

11. Security What risks does use of the service mitigate? Life Safety
Reputational Harm - Risk of non-Cornell entities masquerading as Cornell
Compromise due to visit to remote malicious sites
Abuse of network / university resources
Failure to resolve Security Incidents, Litigation requests, DMCA notices, etc.
Inability to effectively troubleshoot network issues
Non-compliance with university policy

12. Security How does the service mitigate risks?
Maps device and network activity to responsible person
NTP provides official network time
Controls access to official Internet address (IP) and name space and enforces specific business rules
NUBB educates users on their network activity and regulates the consumption of Internet bandwidth
SafeDNS – seamless anti-phishing and malware protection
DNS components are protected, actively patched, monitored 7/24/365

13. More information Service web pages:
Service level expectations: DNS:
Service catalog entry: DNS:
Network Registry:
Service quarterly report: DNS:
Network Registry:

14. Questions? Email questions to: Laurie Collinsworth ljc1@cornell.edu
Rob Bandler