Stop attackers impersonating your domain
Email is the most common entry point for attacks, and a spoofed government domain erodes public trust. Publish and enforce the standard anti-spoofing records so others can reject forged mail claiming to come from you.
Publish SPF to declare which servers may send mail for your domain.
Sign outbound mail with DKIM so recipients can verify it was not tampered with.
Set a DMARC policy, start at monitoring, review the reports, then move to quarantine and reject.
Apply these records to domains you do not use for email too, so they cannot be abused.
Protect inboxes and the people using them
Filter spam and malware at the gateway, warn on external senders, and give staff a simple way to report suspicious messages. Protect webmail and administrator access with multi-factor authentication. Treat business email compromise, where an attacker uses a real or lookalike account to change payment details, as a priority risk.
Secure your public websites and services
Serve everything over HTTPS with valid, monitored certificates and redirect plain HTTP.
Keep the content management system, plugins and server software patched, and remove unused components.
Apply security headers, validate input, and protect administrator logins with MFA and restricted access.
Monitor for defacement, unexpected changes and expiring domains or certificates.
Check your exposure regularly
Scan your internet-facing services for known vulnerabilities and misconfigurations, and fix what you find. Remove test sites and old subdomains that no longer serve a purpose; forgotten web assets are a frequent route in.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.