How gTLDs Enhance Cybersecurity: A Case Study of SBI

SBI's rebranded website using gTLDs enhances customer protection against phishing scams.

Posted by Vijay Koushik on November 16, 2017

#SBI #gTLD #generic-Top-Level-Domain #phishing #cybersecurity #online banking

Note to Readers: This article was originally written in May 2017 and references an event from February 20, 2017. The information may reflect the state of cybersecurity and domain usage at that time.

In a significant move to bolster cybersecurity, the State Bank of India (SBI) rebranded its website from https://www.sbi.co.in to https://www.bank.sbi using a generic Top-Level Domain (gTLD). This makes SBI the first Indian bank to implement its own gTLD, aimed at protecting customers from phishing scams.

What is a gTLD?

A generic Top-Level Domain (gTLD) is the part of a domain name that appears at the end, such as .com or .org. These domains are categorized for specific purposes, such as commercial (.com), organizational (.org), or educational (.edu). However, the unrestricted use of traditional gTLDs has made them vulnerable to misuse in phishing attacks.

Illustration of DNS hierarchy with gTLDs

The Role of gTLDs in Cybersecurity

Phishing attacks often exploit the similarity of URLs to deceive users into revealing sensitive information. A scammer might create a fraudulent website resembling the bank’s official site to trick users into providing their credentials. This is where SBI's new gTLD, .sbi, offers a robust solution:

Exclusive Use:: The .sbi domain is restricted solely to SBI, ensuring that any website or email ending with .sbi is legitimately affiliated with the bank. This makes it easier for customers to verify the authenticity of communications.
Enhanced Trust:: Customers can confidently interact with SBI online knowing that any link with .sbi is genuine, thus reducing the risk of falling victim to phishing.

Understanding Phishing

Phishing is a fraudulent attempt to obtain sensitive information by disguising oneself as a trustworthy entity. This often involves emails or messages that appear to be from legitimate sources, tricking users into clicking links and submitting personal information on fake websites.

Here’s a basic example:

A user receives an email claiming they have won a large sum of money and are asked to provide personal details or make a small payment to claim the prize. This type of scam can be mitigated by checking the sender’s email and the URL of any included links.

Preventive Measures

To protect against phishing:

Email Verification: Always check the sender's email address for authenticity.
URL Inspection: Verify the URL in the browser’s address bar to ensure it matches the official site’s domain.
Test Credentials: On suspicious sites, inputting incorrect credentials can reveal fraudulent attempts if no error message is received.

SBI's gTLD Initiative

The introduction of https://www.bank.sbi marks a significant step towards securing online banking. This restricted gTLD ensures that customers can easily identify genuine SBI communications and websites. SBI plans to extend this gTLD to its other services, further enhancing online security for its customers.

A Quick Guide to Common gTLDs

Below is a list of some common gTLDs and their intended purposes:

gTLD	Purpose
`.com`	Commercial entities, but now unrestricted
`.org`	Originally for organizations, now unrestricted
`.edu`	Educational institutions, primarily in the US
`.gov`	US government entities
`.mil`	US military entities

For a complete list of gTLDs, visit the Wikipedia page on Internet top-level domains.

Conclusion

The adoption of gTLDs like .sbi by banks represents a proactive approach to cybersecurity, providing a reliable method for customers to verify the legitimacy of their online interactions. This move not only enhances security but also builds trust in digital banking services.

Glossary

Address bar: A text box in a web browser displaying the address of the web page that is currently being viewed.
Email Service Provider: a company that offers email services.
DNS: Domain Name System
gTLD: Generic Top Level Domain
Phishing: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
Spam: irrelevant or unsolicited messages sent over the Internet, typically to a large number of users, for the purposes of advertising, phishing, spreading malware, etc.
Website address or Web address: an Internet or intranet name that points to to a location where a file, directory or website page is hosted.

A random quote

Let us not look back in anger or forward in fear, but around in awareness.-James Thurber

Illustration by Wikimedia Commons.