Domain Risk Management – Build or Buy


Our 3-part blogging series ends

We have learned in this blog series that while domain risk management (DRM) may be a straightforward process, it is by no means easy to perform, especially on a large scale. As we have seen, DRM includes the active management of typosquatting domains, both through proactive acquisition and the comprehensive and continuous discovery and assessment of threats.

In the last blog in this series, the focal point turns to decision criteria and considerations for determining the build versus purchase of an effective and scalable DRM program.

Considerations fueling the decision

DRM requires that for each domain owned by an organization, its likely typosquatting variations be discovered and evaluated. If this process is only for one or two domain names, then it will be relatively easy to leverage something like dnstwister to achieve this goal. However, what about an organization that owns many domain names, say 5, 10, 20 or more? This is a problem that cannot be solved by simply increasing the staff (human capital).

In fact, as we’ve learned, DRM can quickly become a problem of seismic proportions – the scale requiring a high level of automation at the core to power an effective program. Companies may choose to create an in-house system to perform this level of monitoring and detection. However, the withdrawal part of the process usually requires legal expertise, bringing in the legal team and quickly increasing the cost of the transaction.

For a small organization with a handful of domain names, manual operation in-house is possible, although it would not be as comprehensive as using a fully automated solution. It is possible to design a program that requires about four to eight hours per week of manual tasks. But if the domain portfolio grows disproportionately faster than the security team, that manual approach and program will be exhausted.

Presentation – Build vs buy

Here is a simple framework to consider and make the right decision for your business.

DRM – Build in-house

● The capabilities of your DRM program are fully customizable, depending on your imagination and needs.
● Since the program is designed in-house, you will have knowledge of both your organization and the program if you need help.
● As your needs or requirements change, you have full control over the program to adjust it as you see fit.

The inconvenients:
● Huge labor costs, especially if you operate and build a software platform in-house.
● The program will be built by a team who may not be qualified in GRC, possibly creating gaps in protection.
● Staff turnover exists in every organization, when the person who developed your program leaves, will it continue to function?

DRM – Buy as a service

● Purchasing a DRM service gives you an immediate, turnkey ROI program that offers 1-day protection.
● Professionally designed DRM will provide the highest level of protection for areas in your organization.
● The ease of use of a DRM service virtually eliminates the challenge presented by the skills shortage.

The inconvenients:
● As a security practitioner, you need to consider where your organization’s data may exist, a DRM service is no different. You should review the platform’s data handling practices.
● You transfer the operation of your DRM to a third party, a rigorous selection of the third party must be carried out to ensure the continuity of the service.
● Lack of customization can be a problem if your organization faces unique challenges in the DRM space.

Final thoughts (the Bolster pitch)

We may be biased here, but we believe that investing in a DRM service from a company like Bolster offers distinct advantages over attempting an equivalent solution in-house. Some of the world’s biggest brands believe so too, leveraging the out-of-the-box automation offered by Bolster to quickly set up a scalable and efficient DRM solution. Find out about the success that Zoom has had and continues to experience with our service. Our solution is enhanced by computer vision, natural language processing and deep learning to identify logos, images and content used to hijack a company’s brand, on websites, media platforms social, app stores, marketplaces, messaging systems, and search engines. Coverage and protection are therefore comprehensive.

When malicious conditions are discovered, the opt-out process is initiated through an API or other automated means with hosting companies, registrars, and content delivery networks, resulting in measured contactless opt-outs. in minutes and hours versus days and weeks. But that’s for another blogging series so stay tuned.


Part 1: Domain Risk Management – Elements of an Effective Program

Part 2: Domain Risk Management Program – Discover Threats

Learn more: strengthen domain protection solutions

Request your free trial today: Bolster Free Trial

*** This is a syndicated Security Bloggers Network blog from Bolster Blog written by Jeff Baher. Read the original post at:


Previous Bill Barker joins Column as an advisor
Next Motorola Moto E40 listed on retailer's website with specs, prices and pictures

No Comment

Leave a reply

Your email address will not be published.