A heads-up for anyone blocking Newly Registered Domains at the web proxy/SWG layer.
We recently had a legitimate new business site we wanted to use quickly appropriately classified as a newly registered domain and therefore blocked by policy. There is data that supports that newly registered sites could be platforms for malicious activities including phishing and is a recommended practice in general to block the site until it’s legitimacy can be established.
Historically, our process was to request recategorization, allowing the Netskope to validate the site, assign the appropriate category, and remove the category “Newly Registered or Parked” category . Internally I called this “vouching for the site”. In effect, we were saying the site was legitimate for use despite for being new, and Netksope would confirm it wasn’t a security risk.
The Netskope current approach appears to preserve the Newly Registered Domain designation even after assigning an appropriate content category.
The operational wrinkle is that organizations blocking that category may now need to create a temporary local exception and, importantly, remember to remove it after the domain ages out of the category in case the categorization changes again. Otherwise, a short-term exception intended only to address the new-domain restriction could leave the site permanently outside security controls that should subsequently apply.
It's a subtle change, but worth considering when designing both NRD blocking policies and exception-expiration processes.
Unfortunately, that practically means that even when a company reports to Netskope that a site is legitimate, other organizations that are Netksope customers or apply the best practice with their proxy vendors will not be able to use the business that has a newly registered site for extended period of time, thus delaying service delivery until someone at that company manually complains to their IT admins.
You should let your employees know that large commercial or informational websites may be blocked, particularly when they rely on content or services hosted on different domains, even when those domains are owned by the same company or partner. (So if they were thinking they were going to have a grand opening, it might be muted for an extensive period of time.)
