We’re always thinking about security and ways to help keep users information as safe as possible regardless of the circumstances.
Due to the nature and sensitivity of the data, we all hold and process, with GDPR now fully in place and everyone is still in the security mindset there are some simple steps we all can take to help.
One step that is rarely thought about is domain security. Attacks of this type are commonly known as “Domain Hijacking” where an attacker gains access to your domain registrar account and points DNS names to locations of their choice.
Could you imagine if someone stole your domain name and intercepted the lead deliveries being sent to that URL?
This can be devastating to the domain name holder, not only financially as they may have commercial income from a website hosted on the domain or conducted business through that domain’s e-mail accounts.
There are many ways in that attackers can gain access to your domain registrar including things such as email vulnerability, vulnerability at the domain-registration level, keyloggers, and phishing sites to name a few.
So What Can You Do?
With the simple steps listed below, we can all help keep customer data secure where important details are being sent over the internet. Remember security is only as strong as the weakest link.
- Use strong secure passwords for DNS portals.
- Use only reputable DNS providers.
- Limit access to people who can control DNS records.
- Lock domain transfers from your registrar and consider paying for registry locking.
- Use 2FA where possible.
- Setup auto-renewal and diarise domain expiry dates.
- Be aware of social engineering.
- Avoid phishing emails trying to scam user details and credentials.
- Don’t click password reset links you didn’t request.
- Consider buying alternate domains i.e. company.com, company.co.uk, company.org (Nominet has reserved the .uk variant for the .co.uk registrar, this reservation expires on the 25th of June 2019)
- Ensure WHOIS information is up-to-date and really points to you
- If you use the same provider for both hosting and domain registration consider using different providers for each.
We highly recommend all deliveries use SSL/TLS (HTTPS) connections which encrypts data transfers to your clients and internal systems. This helps us help you by verifying the endpoint that leads are being delivered to.
For export schedules use SFTP rather than plain FTP connections.
There are handy padlock icons beside your deliveries and export schedules which shows secure/non-secure connections.
We hope that this article has provided a better understanding of domain security and ways in which to better protect your domains. Furthermore, we’re always happy to lend a helping hand here at LeadByte. So be sure to reach out to your account manager for further questions on domain security.