Colleges and universities losing oversight of their domain name portfolios

Pandemic has led to huge registration growth and fragmentation

Young woman taking notes while looking at computer screen and taking math class.

Thursday 21 April 2022
Contact person: Peter Rotgans

Organisations in the Netherlands often ask us to scan our database and tell them exactly what domain names they have, and which registrars they're registered through. Mergers, takeovers and reorganisations can lead to domain names having no 'owner' within an organisation, even though there are still applications and e-mail addresses linked to them. Resulting in administrative chaos and security risks. In the past, such problems occurred mainly at multinationals with numerous subsidiaries and brands. But universities and colleges can struggle to keep an overview as well. And the situation has become a lot worse since the coronavirus pandemic began. So what's going on? And why should security professionals be thinking about this issue now?

Accelerated digitisation

Over the last two years, many universities and colleges have been digitising faster than ever. There's been a particular boom in the use of cloud applications. As one university puts it, the IAAS/PAAS landscape has exploded. With face-to-face teaching halted or reduced, countless new applications and websites have been launched. Many with their own domain names, often registered through a supplier for convenience. And not by the central IT department, but by the team behind the initiative. Universities and colleges where that's been happening now find that they've lost oversight of their domain name portfolios and applications. Regaining that oversight is a task no security team should delay, because of the potential for vulnerabilities going unnoticed. 

Decentralised structures

Universities and colleges are at particular risk because of their traditionally decentralised structure and culture. Faculties often operate independently, with relatively little centralised administration. Where a centrally managed procurement process does exist, it's often so complex that people bypass it. Consequently, many initiatives, departments and faculties have websites created without the involvement of an IT or security professional. Plus matching domain names registered by people frequently unaware of the precautions they should take. The resulting domain name landscape is confusing and fraught with risk.

Man is looking at a business structure concept that he has drawn on a blackboard.

A variety of risks

Loss of domain name portfolio oversight brings a variety of risks, ranging from name confusion and image damage to vulnerabilities that could be exploited by cybercriminals. A recent example involves a domain name registered for advertising vacancies at a university (werkenbij<..>). The name used to point to the university's homepage, but an administrative error meant that the registration expired. The domain name was then snapped up by crooks who used it for a fake webshop selling branded trainers at knockdown prices. Because the domain name still featured in links on university's homepage and still appeared to belong to the university, it retained its Google ranking, enabling the crooks to use it for a spam campaign. So the university's reputation was significantly dented.

E-mail  needs attention too

Something that's often overlooked is that domain name abuse doesn't always involve a website. Many university domain names have e-mail addresses linked to them, which staff and students use to log on to applications. If 2FA isn't used, such addresses can be exploited by hackers to access systems and, for example, instal ransomware.

BrandGuard and the Domain Name Portfolio Checker

Against that background, more and more universities and colleges are opting to continuously monitor domain name registrations with SIDN BrandGuard. BrandGuard flags up any registrations that resemble or include the institution's name. There's also the option of making an inventory of all the domain names registered to the organisation, using the Domain Name Portfolio Checker (DPC). Preventive scanning can save a lot of trouble.  