As the registry operator for .au domain names, Afilias Australia is proud to partner with .au registrar and corporate brand services provider, CSC to present an integrated approach to the current cybersecurity threat environment in Australia.
The internet plays a vital role for most businesses across the country, and cybersecurity should be a top priority. However, as demonstrated by ongoing attacks on Australian institutions, it is evident that there is still much opportunity for improvement.
Current State of Affairs in Australia
The Australian Signals Directorate (ASD) first issued domain name hijacking warnings in 2018, cautioning organisations of malicious actors enabling “man in the middle attacks” on domain name system infrastructure. These types of threats attempt to take full control of a specific domain name and are becoming increasingly frequent.
More recently, while the world was focused on a global pandemic, sophisticated cyber attackers unleashed their forces on a range of sectors within the Australian government, critical infrastructure and essential services. This series of “state-based cyber-attacks” is believed to have been an attempt to gain access to economic and personal data.
News of the attack came with a warning from Australian Prime Minister, Scott Morrison, for Australian organisations to remain vigilant, reminding us that cybersecurity is a shared responsibility and that organisations could follow advice from the Australian Cyber Security Centre (ACSC) to detect and mitigate these types of threats.
Improving our Security Posture
As alarming as this news is, many Australian businesses are yet to act and continue to be exposed. For example, CSC’s 2020 Domain Security Report revealed surprisingly low figures for adoption of security enhancements across Forbes Global 2000 companies. The study indicates that across APAC, the implementation of registry lock services is only 7%, and DNS Security Extension (DNSSEC) adoption is also low, with a mere 1% of organisations using this safeguard.
For Australian businesses that seek guidance on getting started, the ACSC recommends implementing 'The Essential 8' as a prevention strategy. This prioritised list provides guidance to mitigate cyber security incidents, is (relatively) easy to implement and can go a long way in keeping your systems secure.
Image 1: Infographic from CSC' s Domain Name Security Report into Forbes Global 2000 companies
One of Afilias’ goals as a key player in the .au namespace is to help ensure that Australian individuals and organisations recognise the importance of continued security of their online systems. To complement the advice from the ACSC but with specific focus on your domain name, Afilias Australia and CSC have identified four best practices to improve your security posture and protect your online systems:
#1 Apply Registry Lock: Registry Lock places administrative “locks” on your name that protect it against theft, redirection, hijacking and other exploits that can damage your online reputation and have the potential to take you offline altogether. To find out more about Registry Lock enquire with your .au registrar today.
#2 Implement DNSSEC: DNSSEC (Domain Name System Security Extension) provides advanced security capabilities for your domain name. As defined by .au Domain Administration, DNSSEC facilitates the digital signing of internet communications, helping to ensure the integrity and authenticity of transmitted data. Last year Afilias Australia completed the implementation of DNSSEC across the .au zone file, including .gov.au.
#3 Enable 2FA: 2FA (2 Factor Authentication) requires two separate authentication methods before granting access to an account or other online resource. For example, if you forgot your email password, you may have the option to have a code sent to your phone which you can input to gain access to your email account. In this example, the two factors are your username and the code that was sent separately to your phone; unless an attacker has access to both, they cannot access your email. This type of account protection is often in place for VPN access, Password Recovery and Authentication code access.
#4 Consider SSL: In simple terms, SSL (Secure Socket Layer) enables encryption for visitors to your website. If a website shows a padlock icon in the toolbar before the domain name, it means that the website owner has purchased an SSL certificate to keep user information secure. There is a reason that we so often encourage SSL for your .au website – It is easy to set up through your .au domain name registrar and they will be able to recommend the appropriate level of validation for your business requirements.
Combating Cybercrime
The Australian government announced on the 29th of June that they are making a $1.35 billion dollar investment to improve cybersecurity across Australian businesses and protect us from continually evolving cyber threats. Prime Minister Scott Morrison outlined how the funding will benefit Australian businesses:
"The Federal Government's top priority is protecting our nation's economy, national security and sovereignty. Malicious cyber activity undermines that," Mr Morrison said. "My Government's record investment in our nation's cybersecurity will help ensure we have the tools and capabilities we need to fight back and keep Australians safe."
The internet is a vast, competitive, always-on landscape, which means that like any environment, it is constantly exposed to threats and vulnerabilities. As industry leaders, Afilias Australia and CSC urge businesses to consider a multi-layered security approach in managing their digital assets and to ensure they do not remain vulnerable to critically important security blind spots.
With strong warnings from the Prime Minister, it is advised that businesses improve their security posture right away. Cyber-criminals look for “soft” targets that have easily identifiable weaknesses in their systems, so by following best practices such as those outlined above, you can be sure that you are remaining as vigilant as possible in protecting your digital assets and combating cybercrime as it exists today.
For more information visit cyber.gov.au or talk to your .au registrar today.