| Many companies
are finding out the hard way that domain names can be
stolen. Once a domain has been stolen, proving ownership
is difficult at best and often impossible. Consider the
following scenario:
You are three weeks out from your annual
conference or shareholders meeting. You come into the
office one day to find that your e-mail is down. A quick
check of the mail server tells you that it’s working
properly except that no e-mail is reaching it. Another
quick check shows that your website is also offline. After
thirty minutes of agonizing troubleshooting, you decide
to check your DNS servers. Something doesn’t look
right so you check your favorite Whois search to see if
someone has failed to renew the lease.
whois - An Internet
utility that returns information about a domain name
or IP address. For example, if you enter a domain
name such as microsoft.com, whois will return the
name and address of the domain's owner (in this case,
Microsoft Corporation). http://www.webopedia.com |
To your horror, you realize that the domain
is no longer registered in your name. In fact, the registrar
is listed as a company in Thailand and you can’t
even read the details that the search gives you. Your
first reaction is to blame whomever was supposed to renew
the domain and obviously failed to do so. When you confront
the person listed as the administrative contact on the
account, he/she produces a receipt stating that it had
been renewed just a few months earlier for a period of
15 years! You breathe a sigh of relief because now, at
least, you can prove that the domain is rightfully yours
and that you will be able to get it back. In the back
of your mind you are aware, however, that it will be days,
at least, before your website and e-mail will be back
online.
How much would this scenario cost your company?
What if you were unable to get the domain back after all?
Too often, Internet domains are stolen via transfers that
seem legitimate. Organizations usually rely on the Accounts
Payable department to handle this recurring expense and,
therefore, the record sometimes isn’t checked for
validity on a regular basis. Sometimes a former IT firm
is listed as the contact on the record, or sometimes a
former staffer used his/her personal e-mail address as
the contact address. These situations can lead to big
problems if no one is assigned to change the record once
the IT firm or staffer is gone. Even if the separation
is amicable, e-mail addresses and passwords can be compromised
by lax security or, in the case of IT firms, a future
employee who has access to your security records. However
it is compromised, if the transfer appears to be legitimate,
the registrar will likely wash its hands clean of the
situation and leave you scrambling to secure a new domain
name. Meanwhile someone in Thailand could be collecting
your e-mails and web hits.
Here are some tips toward securing
your domain name:
1. Put a lock on transfers.
Most domain registrars will allow you to put a "lock"
on any transfers after you have purchased your domain.
This means that you will not be able to transfer your
domain to another registrar, but no one else will be allowed
to either. If you do need to transfer your domain, you
can temporarily unlock it until the process is complete.
Although not foolproof, this is the single most effective
tactic to ensure that you do not become a hijacking victim.
2. Suppress your contact information.
All registrars collect data about companies and individuals
who register domains. By default, the information displays
in a Whois search. By making this private (usually by
clicking a checkbox), you can reduce the risk of hackers
using this information to pull off a hijack.
3. Trademark your domain.
If you do get hijacked and your domain name is trademarked,
you will have a much easier time proving your case. Trademarking
can cost anywhere from $300 to $3000. If you have an attorney
handle the trademarking of your domain, the costs are
higher than if you file the paperwork yourself.
4. Set up alternative communications.
In the event of a hijacking, your email accounts
will not function or may be compromised. If you use your
email address for sensitive company information or for
customer contact, establish a secondary email address
that is not reliant on your domain name. This will ensure
that you are not completely cut off during a hijacking.
If you have questions about how to protect
your Internet domain name, please call Promethius at 317/733-2388.
|
