{"id":9521,"date":"2020-12-16T09:16:34","date_gmt":"2020-12-16T14:16:34","guid":{"rendered":"https:\/\/www.cscdbs.com\/blog\/?p=9521"},"modified":"2021-11-09T14:10:04","modified_gmt":"2021-11-09T19:10:04","slug":"the-humble-domain-name-is-the-foundation-of-online-security","status":"publish","type":"post","link":"https:\/\/www.cscdbs.com\/blog\/the-humble-domain-name-is-the-foundation-of-online-security\/","title":{"rendered":"All Roads Lead to\u2026 Domains: Why the Humble Domain Name is the Foundation of Your Online Security"},"content":{"rendered":"\n
\"\"<\/a><\/figure>\n\n\n\n

By Stephanie Mitchell,<\/a>
Marketing ManagerShare this post <\/strong><\/span> <\/a> <\/a> <\/a><\/p>\n\n\n\n

For most people, a domain is just an address that you type into a browser, but for businesses, domain names are the foundation of their online presence. A recent article says, \u201cWhen it comes to operating a business online, the domain name is the center of everything. The domain name should ensure a frictionless and painless experience for the company, its customers, its partners and suppliers, and its employees[1]<\/sup>.\u201d<\/p>\n\n\n\n

In this blog, we\u2019ll explore why the humble domain name means so much more with regards to online security, and why good domain security and portfolio management are essential to an organization\u2019s online presence\u2014and what happens without it.<\/p>\n\n\n\n

Setting the scene<\/strong><\/h2>\n\n\n\n

Imagine the scenario. You log into your computer and go to your company website. It\u2019s down, returning an error message. You open your emails to send a message to IT to let them know. It opens, but you can\u2019t connect, and can neither send nor receive emails. You open your company\u2019s softphone application to call IT. That\u2019s not working either. There\u2019s been a security breach; cyber criminals have targeted your organization and now all of your communications tools aren\u2019t working, as well as your website. How did they manage to infiltrate your systems?<\/span><\/em><\/strong><\/p>\n\n\n\n

Here\u2019s another scenario. You work for Toyworld, a manufacturer of children\u2019s toys. Counterfeiters are selling fake versions of your products on bogus websites that look and feel like your website, but offer the goods at vastly discounted prices. It\u2019s not only an intellectual property infringement, it\u2019s also directing traffic away from your website, causing you to lose revenue, and it\u2019s reported that some of the fakes that are battery powered are catching on fire due to shoddy electrics, putting consumers\u2019 health and safety at risk and damaging your reputation. You need to take down these websites as quickly and effectively as possible, but where do you start?<\/span><\/em><\/strong><\/p>\n\n\n\n

Final one; you work for a financial institution and your boss sends you an urgent email asking you to set up a new supplier and pay them as soon as possible. She\u2019ll be in meetings until late, she says, and it needs to be done by the end of the day; it\u2019s 4:50 p.m. What you don\u2019t know is that the email is not from your boss, it\u2019s actually from a phisher trying to extort money from the company. How did the phisher manage to send an email to you posing as your boss?<\/span><\/strong><\/p>\n\n\n\n

The answer to all three of these questions is domains<\/strong>.<\/span><\/p>\n\n\n\n

In the first example, cyber criminals can use domain name or domain name system (DNS) hijacking to take down or redirect websites\u2014or bring down email, virtual private networks (VPNs), and voice over IP (VoIP)\u2014putting that business in jeopardy of revenue or brand reputation loss. When cyber criminals penetrate your domain name or DNS, they can then use phishing techniques to harvest credentials and ultimately breach your network. Such breaches expose personal information and can leave your organization vulnerable to significant financial penalties due to policies like the General Data Protection Regulation (GDPR). All of this can happen through the compromise of a single domain name, making domains a high-risk vulnerability.<\/p>\n\n\n\n

In scenario two, the crux of the issue lies with the existence of the websites in the first place\u2014and to create a website, you must register a domain. The counterfeiter buys a domain that includes your company\u2019s brand name (e.g., toyworld-sale.com), likely at low cost from a retail-grade registrar, and sets up their website with your organization\u2019s branding. With a domain monitoring and takedown service, you can cluster abusive sites owned by the same registrants and get them taken down in bulk.<\/p>\n\n\n\n

Finally, phishing attacks of all kinds\u2014not just a business email compromise (BEC) scam like the example mentioned\u2014start with, yes you\u2019ve guessed it, a domain name. Phishers buy a domain that is usually only one letter different to a genuine domain, or in some cases, they pick up domains that have been accidentally lapsed, and then use social engineering techniques to trick their target into sharing personal details, downloading malware (which can then compromise your DNS), or paying money.<\/p>\n\n\n\n

So as you can see, it only takes one slip-up to bring down your company\u2019s online presence or put consumers and staff at risk when it comes to domains. That\u2019s why at CSC, we advocate comprehensive domain security and portfolio management, brand protection, and fraud protection solutions.<\/p>\n\n\n\n

Protect the king<\/strong><\/h2>\n\n\n\n

Securing domains is like protecting the king in a game of chess\u2014once the king falls, the game is over. The other pieces in the chess set are your means of protecting him; with domains, these pieces are the key security protocols that you can put in place to protect your domains:<\/p>\n\n\n\n