The 2024 Domain Security Report: A Wake-Up Call for Healthcare and Beyond

On October 30, 2024, CSC, a leading enterprise-class domain registrar and expert in mitigating domain and domain name system (DNS) threats, unveiled its fifth annual Domain Security Report. This year’s findings reveal alarming trends, particularly for the healthcare sector, which has seen a significant decline in its domain security ranking amidst a surge in cyber attacks. The report serves as a crucial reminder for industries to prioritize domain security measures to protect against the evolving landscape of cyber threats.

A Shift in Rankings: Healthcare’s Decline

The 2024 report highlights a notable drop in the Healthcare Equipment and Services sector, which fell from 5th to 12th place in the rankings of 26 Forbes Global 2000 industries. This decline is particularly concerning given the dramatic rise in cyber attacks targeting hospitals and healthcare systems this year. The juxtaposition of increased threats and decreased security measures raises critical questions about the preparedness of the healthcare industry to combat these risks.

Understanding the Metrics: Key Domain Security Features

CSC’s report meticulously analyzes the performance of various industries based on the adoption of essential domain security features. These features include registry lock, CAA records, DNS redundancy, registrar type, DNSSEC, SPF, DKIM, and DMARC. The top-performing industries this year were Business Services and Supplies, IT Software and Services, Media, Retailing, Hotels, and Technology Hardware and Equipment. In contrast, the lowest-performing sectors included Construction, Food and Drink and Tobacco, Food Markets, Materials, and Oil and Gas Operations.

Jim Stoltzfus, president of CSC’s Digital Brand Services, emphasized the importance of monitoring domain activity, stating, “Many wide-scale cyber attacks like ransomware, phishing, and data breaches can originate at the domain level through fraudulently registered or exploited legitimate domains.” This statement underscores the need for all industries, especially those in critical sectors like healthcare, to enhance their domain security practices.

Alarming Insights from the Report

The report offers several key insights that highlight the vulnerabilities present in the current domain security landscape:

1. Homoglyph Domains: A staggering 80% of registered web domains that resemble a Global 2000 brand do not belong to that brand. Of these, 42% have MX records, which can be exploited for phishing attacks. This statistic illustrates the potential risks associated with lookalike domains and the need for vigilant monitoring.

2. Registry Lock Adoption: While the use of registry locks has increased by 7 percentage points since 2020, overall adoption remains low at just 24%. Registry locks provide essential security by preventing unauthorized modifications or deletions of domain names, yet many organizations still overlook this cost-effective measure.

3. Zero Security Scores: Alarmingly, 107 of the world’s largest public companies have a domain security score of zero, indicating no adoption of any recommended security measures. This lack of action leaves these companies highly vulnerable to domain security threats.

4. Rise of DMARC: The adoption of DMARC (Domain-based Message Authentication, Reporting & Conformance) has surged by 82% since 2020. This increase is a direct response to the record number of phishing attacks reported in 2023, which reached nearly five million. DMARC is crucial for protecting email domains from spoofing and phishing scams, making its adoption a vital step for organizations.

The Impact of Cybercrime on Major Events

The report also sheds light on how lax domain security can have far-reaching consequences, particularly during high-profile events. CSC observed a significant uptick in fake Olympic and Paris-related domain registrations during the 2024 Paris Olympics. These fraudulent domains were used to promote counterfeit items, fake tickets, and phishing attacks, demonstrating how cybercriminals exploit trusted brands to launch malicious campaigns.

This trend highlights the necessity for organizations to monitor their domain ecosystems actively. By keeping an eye on lookalike, dropped, re-registered, or newly registered domain names, companies can better protect their brands and consumers from digital threats.

Conclusion: A Call to Action

The findings of CSC’s 2024 Domain Security Report serve as a crucial wake-up call for industries, particularly healthcare, to reassess their domain security strategies. As cyber threats continue to evolve and become more sophisticated, organizations must prioritize the adoption of essential domain security measures. By doing so, they can safeguard their digital assets, protect their brands, and ultimately ensure the safety of their consumers in an increasingly perilous online landscape. The time for action is now—because in the world of cybersecurity, complacency is not an option.