Why Domain Protection Is A Key Pillar Of Cybersecurity

Cybersecurity is one of the most challenging areas of technology. In an era of (almost) digital everything, having a spotless and secure online identity has become essential for both businesses and individuals. 

Over the years, this risk has become a real governance issue for companies as it is interconnected with other risks: whether it is a loss of strategic data or an attack on reputation.

There are several types of threats that can make companies vulnerable and put their digital identity at risk, with phishing being particularly prevalent. Just last year, 76% of businesses reported being a victim of a phishing attack. Out of these, internationalised domain name (IDN) homograph attacks account for some of the most dangerous, sophisticated, and effective hacks. These work by hackers using domains that usurp the visual and legitimate identity of a domain, in particular by using characters that appear similar to the Latin alphabet. It is imperative that businesses are able to prevent such attacks.

Understanding Homograph Attacks And The Danger They Pose

A homograph domain is essentially a “look alike” domain. Domain names support international characters to be inclusive of all languages. The trouble arises when bad actors create domains by mixing characters that look similar with the intent of deceiving or defrauding a target. 

One reason as to why these are so dangerous is that there are potentially millions of homographic variations of names. Many phishing attacks are socially-engineered, meaning they rely on a person to trust that the scammer is actually legitimate. A domain name or email address that looks nearly identical to the legitimate name could easily convince a target to take a compromising action. 

The nature of the attack can vary, but the target is convinced because they believe the scammer is the trusted brand, business, or person. What if your boss emailed you a request for a funds transfer, from an email address that looked just like their primary email? We’d all like to think we’d catch the subtle difference in look, but depending on the way the characters are rendered online, the difference might be imperceptible. 

When it comes to IDN homograph attacks, the damage caused can be severe. Thus, prevention is far better than treatment or cure. 

Preserving Digital Identity Means Stability - And Can Even Be A Driver Of Growth

Cybersecurity has always been far more than just a concern over IT. Fighting against data breaches is also about protecting the private information of customers and staff, protecting against regulatory action, and maintaining reputations. 

During a homograph attack, an entire business ecosystem is put at risk, and it only takes one link in the chain to be affected to drag another into trouble. For example, a customer goes to a company's website to make a purchase. They checkout and enter bank details, as visually everything looks legitimate. The customer makes the purchase and only later realises they have been dealing with a malicious site. From that moment on, it is the company's brand that is tainted, since it is as easy for the customer to go to the real website as it is for the impostor. 

The above example may seem simplistic. Yet these circumstances occur regularly, causing great damage to both reputations and to the bottom line. 

Business success is no longer measured solely by economic results, but also by the overall 
image and reputation of the company. Thus, domain protection is key to not just brand protection, but in being able to secure further customer acquisition and growth. 

Acting Upstream And Throughout The Lifetime Of A Domain Name

By putting in place mechanisms to reduce the risks and impact of an attack, companies limit their operational threats. Selecting a domain name with homographic blocking is a key protective step.

An upstream solution can automate this protection from the moment the domain is registered. It does this by identifying all the  characters in the domain name, which then makes it near-impossible for scammers to use homographs to target customers or staff.

This solution must be applied during all the lifetime of the domain, otherwise it will not be a truly preventative measure. Companies would be wise to pick a provider that offers such a solution built in and which covers the lifetime of the domain, to offer complete protection as we see ever increasing and sophisticated homograph attacks. Investing in brand protection — for both customers and staff — is paramount. 

Despite the homograph attacks being known since 2001, it is still one of the major challenges in the cyber security and threat intelligence sector - with the sophistication of these attacks growing exponentially year on year. With risks falling not only on private and public sector companies but also on institutions and individuals, it is necessary for all stakeholders to be aware of the importance of protecting their domain name. 

Brian Lonergan is the Senior Director of Product at Identity Digital

You Might Also Read: 

Deactivated Domains Used For Spear-Phishing:

 

« DARPA Wants To Play With Artificial Intelligence
Artificial Intelligence Distorts Government Decision-Making »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Atlantic Council

Atlantic Council

The Atlantic Council's Cyber Statecraft Initiative focuses on international cooperation, competition, and conflict in cyberspace.

CERT-PA

CERT-PA

CERT-PA is the national Computer Emergency Response Team for Italian government institutions.

Celestya

Celestya

Celestya is dedicated to providing the most advanced and cost effective systems for human behavior education on cybersecurity awareness training.

Entersekt

Entersekt

Entersekt is an innovator in push-based authentication and app security.

Wotan Monitoring

Wotan Monitoring

Wotan Monitoring is the software solution for fully automatic process monitoring, infrastructure monitoring and end-to-end monitoring.

GovCERT Austria

GovCERT Austria

GovCERT Austria is the Austrian Government Computer Emergency Response Team. Its constituency consists of Austria's public administration.

DANAK

DANAK

DANAK is the national accreditation body for Denmark. The directory of members provides details of organisations offering certification services for ISO 27001.

Attack Research

Attack Research

We go far beyond standard tools and scripted tests. Find out if your network or technology can stand real-world and dedicated attackers.

Secured Communications

Secured Communications

Secured Communications has developed the only unified secure communications platform trusted by public safety and counter terrorism professionals around the world.

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute builds on the strength of its members in the area of network and communication security, artificial intelligence, big data and cyber physical systems.

International Cyber Threat Task Force (ICTTF)

International Cyber Threat Task Force (ICTTF)

The International Cyber Threat Task Force is a not-for-profit initiative promoting the ecosystem of an International independent non-partisan cyber security community.

Telesign

Telesign

Telesign connect, protect, and defend online experiences with sophisticated digital identity and programmable communications solutions.

CYBHORUS

CYBHORUS

CYBHORUS are a team of Italian cyber security experts, specialized in cyber threat defense and strategic and organizational consulting.

Acumen

Acumen

Acumen's cyber security engineers protect your critical systems, in critical moments. We are here when you need us most.

Parried

Parried

Parried is a leading Managed IT Services and Cybersecurity provider, known for blending deep technical knowledge with business strategy.

Inoxoft

Inoxoft

Inoxoft delivers IT security consulting, assessment, and protection services to help businesses secure their infrastructure, applications, and sensitive data.