Craig Spiezle - How Does Your Site Rank? Audit of the Top 500 Ecommerce Sites
Presentation by Craig Spiezle at the 2014 DigiCert Security Summit. Video recording: https://vimeo.com/112416916 About Craig Spiezle President and Executive Director of the Online Trust Alliance Mr. Spiezle is a recognized thought leader and pioneer on the convergence of interactive marketing, society, and digital commerce. Leveraging his deep understanding of privacy, security, and data stewardship, Spiezle is a champion of best practices to help protect consumer trust and the importance of promoting the vitality and innovation of the internet. Spiezle frequently briefs members of Congress representing the roles and shared responsibility of members of the ecosystem and the importance of meaningful self-regulation. Prior to OTA, Spiezle spent over a decade at Microsoft in several management roles. Most recently he was the Director of Security & Privacy Product Management, driving development of anti-spam, anti-phishing, anti-malware, and privacy-enabling technologies. During his tenure, Spiezle championed digital inclusiveness and the societal impact of internet literacy and access. Spiezle holds a Bachelor of Science from the Rochester Institute of Technology and an MBA from Seattle University. https://www.digicert.com/events/summit-2014/
Recommended
Recommended
More Related Content
What's hot
What's hot (11)
Viewers also liked
Viewers also liked (7)
Similar to Craig Spiezle - How Does Your Site Rank? Audit of the Top 500 Ecommerce Sites
Similar to Craig Spiezle - How Does Your Site Rank? Audit of the Top 500 Ecommerce Sites (20)
Recently uploaded
Recently uploaded (20)
Craig Spiezle - How Does Your Site Rank? Audit of the Top 500 Ecommerce Sites
- 2. 2014 Online Trust Audit How Does Your Site Rank? Audit of the Top 500 Ecommerce Sites Craig Spiezle Executive Director & President, OTA
- 3. Honor Roll Overview Objective: Move from a “compliance” mindset to “stewardship” Recognize leadership brands, sites & apps that implement security and privacy practices protecting users’ data Incentivize businesses and developers to enhance their security, data protection and privacy practices Make security & privacy part of a brand’s value proposition Increase awareness and preference for best practices © 2014 All rights reserved. Online Trust Alliance (OTA)
- 4. Honor Roll Overview Brand Protection Security Privacy • Analysis of ~800 web sites ▫ FDIC Banking 100 ▫ Internet Retailer 500 ▫ Top 50 Social ▫ Top 50 News/Media (introduced in 2014) ▫ Top 50 Federal Gov’t ▫ OTA Members • Scoring ▫ Up to 100 points in each category ▫ Bonus points for emerging practices ▫ Penalty points for Data loss incident Fines/settlement Failure to follow established practices ▫ Honor Roll = 80% of total points, 55% or better in each category
- 8. Internet Retailer Top 10
- 10. Lowlights
- 11. Brand Protection • Base points ▫ Email authentication SPF and DKIM at top-level and subdomains ▫ DMARC record and policy (increased weight in 2014) • Penalty points ▫ Domain locking (penalty if not locked) Brand Protection Security Privacy
- 12. © 2014 All rights reserved. Online Trust Alliance (OTA)
- 13. © 2014. All rights reserved. Online Trust Alliance (OTA)
- 14. Infrastructure Security • Base points ▫ Server & SSL implementation • Bonus points ▫ EV SSL ▫ AOSSL ▫ DNSSEC • Penalty points ▫ XSS / iFrame vulnerabilities ▫ Malware ▫ Malicious links Brand Protection Security Privacy
- 15. Server Configuration Analysis Common Issues • Support of TLS 2.0 • “Beast Attack” • Mismatched certs • Cross site scripting • iframes exploits Data Sources: SSL Labs - https://www.ssllabs.com & High-Tech Bridge https://www.htbridge.com/ © 2014. All rights reserved. Online Trust Alliance (OTA)
- 19. SSL Configuration © 2014. All rights reserved. Online Trust Alliance (OTA)
- 20. © 2014. All rights reserved. Online Trust Alliance (OTA)
- 21. Enhanced SSL Criteria Two new grades, A+ (100 pts) and A- (90 pts), allow for finer grading. Support for TLS 1.2 required for an A. If not, grade is capped at B. Key lengths below 2048-bit capped at B (below 1024-bit receive an F) MD5 certificate signatures considered insecure, receive an F Warnings – servers with good configuration, but one or more warnings, are reduced to an A- – Servers not supporting Forward Secrecy receive a warning – Servers that do not support secure renegotiation receive a warning – Servers that use RC4 with TLS 1.1 or TLS 1.2 receive a warning © 2014. All rights reserved. Online Trust Alliance (OTA)
- 24. Privacy • Base points ▫ Privacy policy ▫ Third-party trackers on site • Bonus points ▫ Layered privacy policies ▫ Bilingual policies ▫ Do Not Track status, policy ▫ Use of tag management or privacy solution • Penalty points ▫ WHOIS (if Private vs Public) ▫ Data Breach Incidents ▫ FTC / State Settlements Brand Protection Security Privacy Italics = new in 2014
- 26. Privacy – Bonus Points Layered Notice i.e. Publishers Clearing House http://privacy.pch.com/ Reduced word count from over 4,000 words to 475! Adds clarity, readability & transparency
- 27. Call To Action • Continually monitoring • Email authentication • Both SPF & DKIM & DMARC • Monitoring your server configuration • Privacy policy and practices for alignment • Scan all third party ads and content © 2014. All rights reserved. Online Trust Alliance (OTA)
- 28. Tools & Resources • Online Trust Honor Roll https://otalliance.org/HonorRoll • Mobile Best Practices https://otalliance.org/resources/mobile.html • 2014 Data Protection & Breach Readiness Guide https://otalliance.org/Breach.html • Email Security https://otalliance.org/auth.html • Always On SSL SSL Best Practices https://otalliance.org/resources/always-ssl- aossl • Malvertising / Ad Integrity https://otalliance.org/AdIntegrity Craig Spiezle craigs@otalliance.org +1 425-455-7400
Editor's Notes
- Includes 11 due to ties Ranged from #4 ranked Walmart to #476 Books-A-Million