Information security control

A domain name registrar must continuously monitor its operations to either identify or prevent events that interfere or threaten the operations.

A domain name registrar must ensure that events that are significant to information security are identified. In order to monitor the operations, the registrar must be able to identify information security violations and threats related to the operations. In practice, this means that the registrar must maintain a management system for its services.

Identifying threats

A registrar's proactive and prompt actions are crucial in identifying disturbances. If a domain name registrar is well equipped to identify disturbances, the measures to detect, control and remedy information security disturbances can be initiated quickly, without having to wait until customers complain.

A registrar shall monitor constantly the state of information security in its operations. The monitoring must be carried using a management mechanism suitable for the registration operations which identifies any events affecting the state of information security as soon as possible. Such events include

  • DoS attacks
  • data leaks
  • hacking attempts
  • excessive user authorisations.

Prevention of threats

The prevention of information security disturbances aims at identifying even the smallest signs of emerging problems as early as possible. Through prevention, their impact on domain name registration operations may be minimised. In the best scenario, there is no visible impact at all.

A domain name registrar must attempt to identify events that are developing into problems using its service management mechanisms. Such mechanisms may include:

  • software alerts and service quality metrics that indicate deviations from normal operations even when an immediate disturbance is not detected. The registrar is responsible for determining appropriate alerts and metrics.
  • alerts of identified hardware or software vulnerabilities predicting information security incidents.

Monitoring documentation

The domain name registrar must prepare and maintain up-to-date documentation of the management mechanisms for domain name registration operations to be able to demonstrate, when necessary, how it meets the set requirements.

Systems and procedures used for receiving and analysing various alerts and notifications must be documented and the documentation must be kept up to date. In other words, a domain name registrar must have a description of the technical systems and measures it uses to process information and notifications on the state of its services.

Key words: Internet , Domain names

LinkedIn Print