Client
A multinational consumer goods group with brands and regional storefronts in more than sixty countries
Sector
Consumer Goods & Digital Trust
Engagement
Domain and DNS inventory, certificate monitoring and registrar access hardening - multi-quarter programme.
What the client needed
Over two decades the group had registered domains for campaigns, acquisitions and market launches, spread across dozens of registrars and registries. Nobody held a complete list. Several lapsed or pointed at services long since switched off, and a few sat on country registries where the group had never logged in again. The trigger was a reported hijack of a small national registry and a wave of unauthorised certificates for global brands in neighbouring cases, which led the security director to ask a question nobody could answer: if a certificate were issued tomorrow for one of our regional names, who would know?
How we worked
- Built the register from four sources at once: registrar accounts, DNS zone exports, public certificate logs and the marketing team's own campaign lists. The gaps between them were the interesting part.
- Subscribed every name, including parked and lapsed ones, to certificate transparency monitoring, with alerts to a staffed channel rather than a mailbox.
- Published strict CAA records on every name, tied to the group's certificate account wherever the issuing authority supported it.
- Moved registrar and registry accounts to named owners with hardware-key sign-in, removed seven former staff and two agencies, and applied registry lock to the highest-value names.
- Consolidated registrars, and let low-value names lapse deliberately, after checking nothing still referred to them.
- Wrote a runbook for an unexpected certificate, including the issuing authority's problem-report route and a standing decision on who may take a site offline.
Measured results
All figures verified with the client. Domain counts and brand names withheld in line with our standard confidentiality terms.
- The group now has one register covering every domain it owns, with a named owner and a renewal date for each.
- Several hundred names were found that no one had listed, and a meaningful share were consolidated or retired.
- Certificate issuance for any group name now reaches the security desk within the hour, and the first unrequested certificate found, for a parked name, was reported and revoked the same day.
- No registrar or registry account relies on a shared password or on a former employee's email address.
- The incident runbook has been exercised once in a tabletop exercise with brand and legal teams.
"We spent years defending the domains we knew about. The surprise was how many we had forgotten, and that each one carried our name. Having a list, and someone looking at it, is less exciting than any tool and far more useful."
Working on something similar?
If this engagement looks like the kind of problem you are facing, we would be glad to compare notes by email.
Context and constraints
The brand teams owned the names and the security team owned the risk, and neither could change the other's systems. We had to build trust before we built tooling, so the first month was spent with marketing and legal agreeing what "owned" meant and who could say a name was safe to drop. Some names were deliberately held for trademark reasons and had to stay, even with nothing behind them.
Why the register came before the monitoring
Alerts on an unknown estate are noise. Until we had reconciled the registrar lists against what appeared in certificate logs, we could not tell a genuine issuance from one a regional agency had requested years ago and forgotten. Matching the two sources showed which names were live, which were orphaned and which belonged to somebody else altogether.
Where control really sits
We assumed the web servers were the sensitive part. They were not. The registrar login and the registry account decide who can pass a certificate authority's validation, and those were protected by a password and, in two cases, a mailbox that no longer existed. Fixing those was cheaper than anything else on the programme and removed the most important single path to a fraudulent certificate.
Lessons learned
The first lesson was to count before acting, because the true size of the estate was about three times what anyone had estimated. The second was that letting names lapse is a security control, but only after you have confirmed nothing still points at them. The third was to give the alerts a named human and a decision in advance, since an unexpected certificate is the sort of event where hesitating costs the most.
If your regional and legacy domains are tracked in a spreadsheet, or not at all, we would be glad to talk. Email sales@halfteck.com.