Website Security Services with DNS Security and Filtering

A WAF, short for web application firewall, is a filter that sits in front of a website or web application and inspects each web request before it reaches the site. It blocks requests that match attack patterns, such as injection attempts and known exploits. Unlike a network firewall, it understands web traffic.

How it is used:

• Login and contact forms: blocking automated attempts to inject commands through form fields.
• Patch gaps: a rule can block attacks on a newly published flaw while the fix is being applied.
• Payment pages: a common way to meet card industry rules for public-facing web applications.

A DDoS attack, short for distributed denial-of-service attack, floods a website, server or network with traffic from many sources at once, so legitimate visitors cannot get through. DDoS protection absorbs or filters that traffic before it reaches your site, usually across a large network built to handle traffic spikes.

How it is used:

• Public websites: keeping the site reachable during a flood of junk traffic.
• Customer portals: protecting logins and online payments that customers depend on.
• Incident response: identifying an attack quickly and filtering it instead of taking the site offline.

A CDN, short for content delivery network, is a group of servers in many locations that keep copies of a website's images, scripts and pages and serve them from the location closest to each visitor. This can make pages load faster and spreads traffic so the origin web host carries less load.

How it is used:

• Speed: visitors in other regions load pages from a nearby server.
• Traffic spikes: cached pages keep loading when a promotion or news story sends a rush of visitors.
• Security: many CDNs also provide WAF and DDoS protection, but those features must be turned on.

A reverse proxy is a service that receives traffic on behalf of your website, checks or filters it, and then passes allowed requests to the server where the site is hosted. Visitors connect to the proxy, not directly to your host. Cloudflare works this way, which is why your site can stay where it is.

How it is used:

• Keeping your host: adding protection without moving the website.
• Hiding the origin: making it harder for attackers to find and hit the hosting server directly.
• One place for rules: applying security and certificate settings in one layer.

Bot management is the practice of telling automated traffic apart from real people and deciding what each bot may do. Helpful bots, such as search engine crawlers, are allowed; abusive ones that scrape content, try stolen passwords or submit spam forms are challenged or blocked. It complements a WAF, which focuses on individual malicious requests.

How it is used:

• Logins: slowing down credential stuffing, where bots try leaked username and password pairs.
• Forms: cutting spam and fake sign-ups.
• Search visibility: making sure legitimate search engine crawlers are not blocked.

Rate limiting is a rule that caps how many requests a single visitor, device or address can make in a set period of time. Normal visitors never notice it, but scripts that hammer a login page, search box or contact form are slowed down or blocked once they pass the limit.

How it is used:

• Password guessing: limiting repeated sign-in attempts on a login page.
• Forms: stopping one source from submitting a form hundreds of times.
• Cost control: protecting expensive pages or searches from being overloaded by scripts.

TLS, short for Transport Layer Security, is the encryption that protects data moving between a browser and a website, shown as HTTPS (Hypertext Transfer Protocol Secure) and a padlock. SSL, Secure Sockets Layer, is its older, retired predecessor, though people still say "SSL certificate". Certificates prove a site's identity and expire, so they must be renewed.

How it is used:

• Customer trust: browsers warn visitors away from sites with expired or invalid certificates.
• Forms and logins: keeping passwords and form entries private in transit.
• Configuration: turning off outdated protocol versions so connections use current ones.

Website hardening is reducing a website's attack surface by tightening its settings: limiting and protecting admin accounts, requiring MFA, removing unused plugins and themes, keeping software current, setting file permissions correctly and confirming backups exist and can be restored. It closes the easy doors attackers check first.

How it is used:

• After a launch or redesign: removing test accounts and leftover plugins.
• Staff changes: removing admin access for people and agencies who no longer need it.
• Recovery planning: confirming there is a recent backup before something goes wrong.

The OWASP Top 10 is an awareness document from the Open Worldwide Application Security Project (OWASP), a nonprofit foundation. It lists the most critical security risk categories for web applications, such as broken access control, injection and security misconfiguration, and is updated periodically. Developers and security teams use it as a common starting checklist.

How it is used:

• Development: a checklist for reviewing a new web app or customer portal.
• Vendor questions: customers ask whether an app has been reviewed against it.
• Testing: a common reference for scoping web application security tests.

CVE, short for Common Vulnerabilities and Exposures, is a public program that gives each publicly disclosed security flaw a unique identifier, such as CVE followed by a year and a number. The shared ID lets vendors, scanners, patch notes and security advisories all refer to the same flaw in the same way.

How it is used:

• Patching: matching a plugin update to the specific flaw it fixes.
• Prioritizing: checking whether a CVE appears in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• Reporting: listing which known flaws were found and fixed during a review.

SQL injection, short for Structured Query Language injection, tricks a website into running an attacker's commands against its database through a form field or web address. XSS, short for cross-site scripting, slips an attacker's script into pages other visitors load. Both come from trusting user input and are classic web application attacks.

How it is used:

• Search boxes and forms: common places attackers test for injection.
• Customer data: injection can expose or change records stored in the site's database.
• WAF rules: managed rule sets block many known injection and XSS patterns.

An API, short for application programming interface, is a defined way for one piece of software to request data or actions from another. Websites and apps use APIs to connect to payment services, customer relationship management systems, maps and AI tools. Every API that is reachable from the internet needs the same protection as a login page.

How it is used:

• Integrations: a website form sends leads to your sales system through an API.
• Apps built with AI tools: connections to company data should use scoped API access, not one person's sign-in.
• Protection: WAF and rate limiting rules can cover public API endpoints too.

DNS, short for Domain Name System, is the internet's address book. It translates a domain name such as btigroup.com into the numeric addresses computers use, and it tells the world where to deliver your email. If your DNS records are changed or wrong, your website and email can go somewhere else.

How it is used:

• Websites: pointing your domain name to the server or service that hosts your site.
• Email: telling other mail servers where to deliver messages for your domain.
• Security: publishing records such as SPF, DKIM and DMARC that protect your email domain.

DNS records are the individual entries in your domain's DNS zone. An A record (address record) points a name to a numeric address, a CNAME (canonical name) record points one name to another, an MX (mail exchanger) record directs email, and a TXT (text) record publishes information such as email authentication policies.

How it is used:

• Website moves: updating A or CNAME records when the site changes host.
• Email changes: updating MX records when moving to a new email service.
• Clean-up: removing records that point to services you no longer use.

A registrar is the company you buy and renew your domain name through, and where your account controls its settings. A registry is the organization that runs a top-level domain, such as .com, and keeps the master list of names under it. Registrars pass your changes to the registry on your behalf.

How it is used:

• Ownership: making sure the registrar account is in the company's name, not a former employee's or agency's.
• Renewals: keeping payment and contact details current so the domain does not lapse.
• Protection: registrar lock and registry lock are set at these two levels.

A registrar lock, also called a transfer lock or client transfer prohibited status, is a setting that stops your domain from being transferred to another registrar until the lock is removed from your account. It blocks many transfer attempts, but it cannot stop someone who already controls your registrar login, which is why MFA matters too.

How it is used:

• Everyday protection: a standard setting every business domain should have turned on.
• Planned moves: unlocking briefly and on purpose when you change registrars.
• Account reviews: confirming the lock is still on during periodic security checks.

A registry lock is a stronger protection set at the registry level. Once it is on, changes to the domain, such as transfers, deletion or nameserver changes, require a manual, out-of-band verification between the registrar and registry. It is not offered for every domain ending and often costs extra.

How it is used:

• High-value domains: the main website and email domain of a well-known brand.
• Social engineering defense: a phone call to a registrar alone is not enough to move the domain.
• Change planning: scheduling nameserver changes ahead because unlocking takes time.

Domain hijacking is when someone takes control of your domain registration or DNS without permission, usually by stealing registrar login details or impersonating the owner. They can then redirect your website, intercept email or transfer the domain away. Recovering a hijacked domain can take time and disrupt the business.

How it is used:

• Email interception: changing MX records so your messages go to the attacker.
• Fraud: sending visitors to a fake copy of your site to collect logins or payments.
• Prevention: registrar lock, MFA, current contacts and access reviews.

DNSSEC, short for Domain Name System Security Extensions, adds digital signatures to your DNS records so that resolvers which validate DNSSEC can detect answers that were forged or altered on the way. It does not encrypt DNS traffic and does not stop someone who controls your DNS account from making changes.

How it is used:

• Forged answers: helping prevent visitors from being sent to a fake address.
• Email security: some email protections can rely on DNSSEC-signed records.
• Setup: enabled only where your registrar and DNS host both support it.

Protective DNS, also called DNS filtering, is a DNS service that checks each lookup your computers make against threat intelligence and refuses to connect to known malicious or unwanted domains. Because almost every connection starts with a DNS lookup, it can stop phishing and malware sites before a page loads.

How it is used:

• Phishing links: blocking a known bad site even after someone clicks.
• Infected devices: cutting off malware that tries to contact its control servers.
• Acceptable use: blocking unwanted categories on office networks and managed devices.

A dangling DNS record is an entry that still points to a cloud service, web host or app you no longer use. If someone else can claim that service, they control a subdomain of your website, such as a promotions or old support address, and can host convincing scams on it.

How it is used:

• Old campaigns: a retired landing page left pointing at a closed hosting account.
• Cloud clean-up: removing records when an app or storage service is shut down.
• Reviews: listing every record and confirming each one still has an owner.

SPF, short for Sender Policy Framework, is a DNS record that lists the mail servers and services allowed to send email for your domain. Receiving mail servers check it to spot messages from senders that are not on your list. It works best together with DKIM and DMARC.

How it is used:

• Email services: listing your main email platform as an approved sender.
• Third-party senders: adding the marketing, billing or website form services that email on your behalf.
• Deliverability: helping legitimate messages avoid spam folders.

DKIM, short for DomainKeys Identified Mail, adds a digital signature to outgoing email. The matching public key is published in your DNS, so receiving servers can confirm the message was sent by an authorized system for your domain and was not changed in transit.

How it is used:

• Message integrity: showing that an invoice email was not altered on the way.
• Vendor setup: turning on DKIM signing for each service that sends mail as you.
• DMARC alignment: giving DMARC a trusted signal to check.

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a DNS record that tells receiving servers what to do with email that fails SPF and DKIM checks for your domain: monitor it, send it to spam, or reject it. It also sends reports showing who is sending email using your domain.

How it is used:

• Spoofing defense: stopping criminals from sending fake invoices as your company.
• Visibility: reports reveal forgotten services that send email for you.
• Enforcement: moving step by step from monitoring to quarantine or reject.

BIMI, short for Brand Indicators for Message Identification, is an email standard that lets supporting mailbox providers show your brand logo next to messages from your domain that pass authentication. It requires DMARC at an enforcement setting, and some mailbox providers also require a mark certificate that verifies the logo.

How it is used:

• Brand recognition: customers see your logo next to genuine messages in supporting inboxes.
• Motivation: a visible reason to finish moving DMARC to enforcement.
• Marketing email: adding recognition to newsletters and notices.

MFA, short for multi-factor authentication, is a sign-in method that requires two or more different kinds of proof: something you know, such as a password; something you have, such as a phone app or security key; or something you are, such as a fingerprint. It blocks many attacks that rely on stolen passwords.

How it is used:

• Registrar and DNS accounts: the single most important protection against domain hijacking.
• Website admin logins: stopping bots that try leaked passwords.
• Hosting and Cloudflare accounts: protecting the controls that sit in front of your site.

Zero trust access is a security approach in which no user or device is trusted just because it is on the office network. Each request to reach an app is checked against identity, device health and policy before access is granted. The National Institute of Standards and Technology (NIST) describes the model in Special Publication 800-207.

How it is used:

• Admin pages: putting a website's admin area behind company sign-in instead of exposing it to the internet.
• Remote staff: reaching internal apps without a traditional virtual private network.
• Contractors: granting a web developer access to one app, not the whole network.

SASE, short for secure access service edge, is an approach that delivers networking and security services, such as web filtering, zero trust access and firewall protection, from the cloud instead of from boxes in each office. Users get the same protection wherever they work, and policies are managed in one place.

How it is used:

• Multi-location organizations: one set of security policies for every office.
• Hybrid work: the same web filtering at home as in the office.
• Simplifying: fewer separate appliances to maintain at each site.

MDR, short for managed detection and response, is a service in which a security team monitors your devices and systems for signs of attack, investigates alerts and takes action to contain threats. It pairs detection technology with people who respond, instead of leaving alerts for an internal team to sort through.

How it is used:

• After hours: suspicious activity on a laptop or server is investigated when it happens.
• Containment: isolating an infected device to stop an attack from spreading.
• Reporting: showing leadership and insurers that threats are watched and handled.

A vCISO, short for virtual chief information security officer, is an outside senior security leader who provides security strategy, risk decisions and leadership reporting on a part-time or shared basis. It suits organizations that need executive-level security guidance without a full-time hire. Every BTI app security engagement includes BTI's vCISO service.

How it is used:

• App security: leading the review and decisions on a custom or AI-built app.
• Leadership reporting: explaining website and domain risk in business terms.
• Program ownership: deciding which risks to fix first and which to accept.

An AI-built app, sometimes called a vibe-coded app, is software created largely with an AI (artificial intelligence) coding assistant, often by someone who is not a professional developer. These apps can work well, but they often lack company sign-in, secrets management, logging, backups and monitoring unless someone adds them.

How it is used:

• Internal tools: a quoting tool or field app built in a weekend.
• Production readiness: checking an app against a security checklist before wider rollout.
• Governance: moving the app into a company-owned environment, such as Azure.

A NOC, or network operations center, monitors the health, availability and performance of networks and systems. A SOC, or security operations center, monitors for threats, investigates alerts and coordinates response. BTI's 24/7 NOC/SOC means both kinds of monitoring run around the clock, including nights, weekends and holidays.

How it is used:

• After hours: a suspicious sign-in at 2 a.m. is investigated, not left for Monday.
• Outages: a failed device or circuit is spotted before staff arrive.
• Customer questions: answering who monitors your environment and when.

SOC 2, short for System and Organization Controls 2, is an attestation framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm reports on a service organization's controls for security, availability, processing integrity, confidentiality and privacy. Customers often request SOC 2 reports from software and service vendors.

How it is used:

• Vendor reviews: a customer asks a software or service provider for its SOC 2 report.
• Readiness: organizations preparing for a SOC 2 examination map their controls to its criteria.

ISO 27001, formally ISO/IEC 27001 from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), is the international standard for an information security management system: the policies, risk processes and continual improvement an organization uses to manage security. BTI's operational governance is ISO 27001 compliant and independently reviewed.

How it is used:

• Enterprise customers: a common reference point in vendor security reviews.
• Program structure: a model for organizing policies, risk assessment and improvement cycles.
• Choosing providers: a signal that a provider's own governance follows a recognized standard.

GSA, the U.S. General Services Administration, is the federal agency that manages government buying programs, including the Multiple Award Schedule that federal agencies use to purchase products and services from pre-approved contractors. BTI is a GSA contract holder (47QTCA21D00BA), which lets eligible government buyers purchase through that contract vehicle.

How it is used:

• Federal agencies: buying from a contract that has already been competed and approved.
• Procurement review: confirming a vendor's contract number before purchase.

CMAS, short for California Multiple Award Schedules, is a California Department of General Services program that state and local government agencies in California can use to purchase products and services, including IT, from contractors whose pricing and terms were already established. BTI is a CMAS and TESMA contract awardee (California).

How it is used:

• California public agencies: purchasing through an existing schedule instead of a new bid.
• Procurement review: confirming the contractor holds an active award.

TESMA, short for Telecommunications Equipment and Services Master Agreement, is a master agreement administered by the County of Los Angeles Internal Services Department. It gives county departments a pool of prequalified providers for telecommunications equipment and services, including installation and maintenance of voice, data network and related systems.

How it is used:

• Los Angeles County departments: obtaining telecommunications equipment and services from prequalified vendors.
• Project bids: work is competed among prequalified contractors project by project.