Security Audit Shows Gains, Though Privacy Lags

The 2018 Online Trust Audit shows that "encryption everywhere" is improving security, while fuzzy language is slowing privacy gains. Many organizations talk about website security, but how many live up to the talk? That's the question the Internet Society's Online Trust Alliance (OTA) sought to answer with its annual "Online Trust Audit & Honor Role," which examined more than 1,200 websites to measure their implementation of best practices in three areas: consumer protection (DNS, domain, and brand protection); site, server, application, and infrastructure security; and privacy, transparency, and disclosures. This marks the 10th year of the comprehensive audit. "Every year we adjust, looking for the latest best practices that are practical and reasonable for companies of most sizes," says Jeff Wilbur, technical director of the Online Trust Initiative for The Internet Society. The changing perspective on best practices is important, he says, "especially these days with cloud services, where you can get pretty sophisticated things even if you're a small organization." The good news is that 70% of the websites analyzed this year scored high enough to qualify for the honor roll, up from 54% in the 2017 audit. "Overall, the two big things that jumped out were [best practices around] email authentication and end-to-end encryption of the entire Web session," Wilbur says.