6 Steps to Protect Your Company’s Domain Privacy

What is Domain Privacy and Security?

Domain privacy and security is the practice of implementing security measures, controls, and technologies that protect your company domain name against malicious cyber threats. The goal is to prevent adversaries from gaining unauthorized access to your company domain, hijacking DNS requests to your domain, or executing successful domain/email spoofing attacks.

Domain cyberattacks happen in a variety of ways—and cyber criminals are always looking for new ways in. A comprehensive approach to domain privacy and security is vital and should cover:

• Domain name registration
• Domain access controls
• DNS security
• Encryption
• Email authentication
• Domain monitoring

Types of Domain Cyberattacks

With a comprehensive approach to domain security, you can prevent or mitigate the following types of domain cyberattacks:

• Email Spoofing
  Email spoofing tricks the recipient of an email into thinking that it came from your official company domain, when it was really sent by a threat actor. 
• Domain Spoofing
  When an online adversary creates a copy of your website on a domain that they control and impersonates your brand in an attempt to scam your customers.
• DNS Spoofing
  DNS Spoofing is when an unauthorized cyber adversary exploits the DNS system to change the responses to DNS queries and divert web traffic from the target domains.
• Denial of Service (DOS) Attacks
  A DoS or Distributed Denial of Service (DDoS) attack attempts to disrupt the availability of your company website by flooding your IP address and network infrastructure with junk traffic.
• Registrar Hacking
  When the designated registrar for your company domain name is hacked and attackers gain administrative access to your domain. Web traffic can then be diverted to a malicious website.
• Domain Hijacking
  Also known as domain theft, this is a type of account takeover attack where a cyber adversary gains unauthorized access to your company domain control panel.
• Typosquatting
  Typosquatting is when a cyber adversary registers a domain name that is similar to yours, but contains a common spelling error that your customers might make when attempting to access your website.

6 Steps to Create a Comprehensive Domain Protection Strategy

Following these best practices will help your organization protect your domain privacy and security.

Step 1: Choose a Reputable Domain Name Registrar

The first step to shoring up your domain privacy should always be choosing a reputable domain name registrar. 

How to Protect Domain Privacy When Registering a New Domain

1. Look for a Domain Registrar that is accredited from registry operators and the Internet Corporation for Assigned Names and Numbers (ICANN). 
2. Choose a registrar that can demonstrate investment and expertise in cybersecurity, including controls, processes, technologies, and staff training. 
3. List yourself as the owner of record to ensure that nobody else can hold your domain name hostage against your will. 

Domain Privacy Tip: Take ownership of a domain name before you register it as an LLC. If you don’t, there’s a good chance your domain name will be snapped up by an opportunistic squatter who may try to sell it back to you at an exorbitant cost.

Step 2: Register Lookalike Domain Names

The easiest way to start defending against typosquatting and domain spoofing attacks is to register lookalike domains yourself and redirect them to your company’s real website. Registering these domains on your own means that they can’t be registered by cyber adversaries who would use them to divert traffic away from your website and potentially scam your customers.

As you work to register domain names similar to yours, you may wish to include:

• Domain names that are typographical errors of your domain name
• Domain names that look similar to your domain name, with just one or two character differences
• Similar or identical domain names under other top-level domains (e.g. dot-info, dot-co, dot-biz, etc.)

Domain Privacy Tip: Domain hijacking can sometimes happen when your domain registrations unexpectedly expire, or when a cyber attacker successfully impersonates your business to your designated registrar.

Step 3: Secure Access to Your Domain

Securing access to your domain control panel and controlling user permissions are important steps to preventing domain hijacking attacks. A number of employees at your organization may require access to your domain control panel to fulfill their job duties, but only trusted individuals should be assigned elevated permissions to modify staff permissions or implement DNS configuration changes. 

Most domain registrars offer features like two-factor authentication and IP validation that can help verify the identity of a user logging into your domain control panel. Here’s how it works:

DNS Security in Action

1. Your organization activates two-factor authentication and IP validation in your domain registrars security setting.
2. An online attacker attempts to gain access to your domain control panel by contacting your domain name registrar and impersonating your business. 
3. Your registrar prevents these attacks by following your authorized contact policy and implementing DNS changes only when requested by trusted, verified individuals at your company.

Step 4: Fortify Your DNS Security

The best way to strengthen your defenses against DNS spoofing and related DNS attacks is by enabling the DNS Security Extensions (DNSSEC) for your organization’s DNS servers.

DNSSEC adds data origin authentication and data integrity protection to the core DNS protocol, cryptographically verifying both the identity of the sender and the integrity of the data received. These features make your domain less susceptible to DNS attacks, such as “man-in-the-middle” attacks.

Step 5: Validate Emails with DMARC

A key step to protect against email spoofing attacks that impersonate your domain is to configure Domain-Based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a protocol that leverages the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) standards to validate the authenticity of email communications.

How DMARC Works:

1. With SPF, your company can detail the specific IP addresses that are authorized to send mail on behalf of your domain. 
2. Recipients of an email from your company can compare the sender’s IP address to those listed on your SPF records. When the addresses match, the email is determined to be authentic. 
3. With DKIM, individual email messages are cryptographically signed and can be authenticated by the recipient on arrival.

Domain Privacy Tip: When DMARC authentication fails, information captured in the failure report can help identify other abuses. ZeroFox Adversary Disruption can process this information easily, adding significant protection and minimizing impact on IT staff and users.

Step 6: Implement Continuous Domain Monitoring and Protection

Threat actors are increasingly innovative in their domain-based cyberattacks. Because the attack surface is so large, and attacks against domains are so common, it is easy for organizations to feel inundated with alerts. Continuous monitoring is crucial to detect domains that may be impersonating or pirating your brand, products, trademarks, or other intellectual property.

How Continuous Domain Monitoring Works

Continuous domain monitoring uses advanced technologies to constantly monitor the public attack surface and detect potentially fraudulent domains and subdomains associated with your company, brand, and executives. 

Examples of Continuous Domain Monitoring Technology

• Fullstring/substring matching and content matching to detect potentially fraudulent content or databases
• Monitoring potentially malicious parked domain registrations and alerting when they subsequently become active
• AI-driven processes like Optical Character Recognition (OCR), image comparison, and fuzzy-matching to detect potential impersonation or fraud

ZeroFox Helps You Enhance Domain Security and Counteract Adversaries

By continuously monitoring for newly registered domains that closely resemble your brand, ZeroFox Domain Protection provides comprehensive protection against fraudulent domains, from identification to takedown.

How ZeroFox Domain Protection Works

ZeroFox Domain Protection leverages artificial intelligence to detect and identify typosquatting and domain phishing attacks that target your brand, employees, and customers. Once detected, ZeroFox works on your behalf to takedown fraudulent online attacker infrastructure and discourage future domain spoofing or impersonation attacks against your brand community.

Our customers are able to find and eliminate typosquatting and domain phishing targeting employees and customers, making it easier than ever to protect domains against spoofed phishing URLs and other attempts to exploit employees and enterprise clients. 

Ready to learn more? 

Download the full ebook for more insider tips on protecting your domain privacy and security.

Download ebook »