FTC orders GoDaddy to fix its infosec practices – Source: www.csoonline.com

Web-hosting giant GoDaddy has been called out by the US Federal Trade Commission (FTC) for its lax security practices, since at least January 2018, with an order to immediately implement a tighter infosec program.

An FTC complaint signed by five commissioners accused the leading domain registrar of lacking standard security practices to ensure hosting data safety.

“Since 2018, GoDaddy has violated Section 5 of the FTC Act by failing to implement standard security tools and practices to protect the environment where it hosts customers’ websites and data, and to monitor it for security threats.”

The complaint added GoDaddy failed in critical security practices, making its security claims misleading.

A whole bunch of security failures

FTC found GoDaddy’s data security program inadequate and unreasonable for a “company of its size and complexity”.

The charges of failure slammed by FTC include areas like inventory and asset management, software updates, risk assessment, MFA implementation, logging security events, monitoring threats, network segmentation, and establishing secure connections to consumer data.

“As a result of GoDaddy’s data security failures, it experienced several major compromises of its hosting services between 2019 and December 2022, in which threat actors repeatedly gained access to its customers’ websites and data, causing harm to its customers and putting them and visitors to their websites at risk of further harm,” FTC noted.

Within the duration of alleged lax security, GoDaddy was hit with a number of security incidents, including the Managed WordPress data breach in 2021, and cPanel malware attack in 2022, which the company later confirmed to be a multi-year hacking campaign targeting its infrastructure.

Gets off easy

Instead of getting into a host of troubles for allegedly failing security at such a scale, GoDaddy seems to have been let off easy as the commissioners decided to allow a 90-day breather to implement some security changes.

In a proposed settlement order, FTC demanded that GoDaddy, within 90 days of finalizing the order, establish, implement, and thereafter maintain a comprehensive information security program.

The company is further required to document and regularly update its information security program, providing it to relevant governing bodies at least annually and after any significant security incident. It must designate a qualified employee to oversee this program and assess risks to security and confidentiality, updating their findings annually and after incidents.

GoDaddy was also asked to implement safeguards to mitigate risks, maintain system inventories, use automated tools for real-time security analysis, manage audit logs, and ensure secure authentication methods (MFA), with regular updates to align with industry standards and past incidents.

FTC said it would publish the consent agreement in the Federal Register for a 30-day public comment period, after which it would decide to finalize the order. Instructions and comments will be on Regulations.gov.

The settlement order also noted that GoDaddy neither admitted nor denied any of the allegations in the complaint but acknowledged the order and said it was prepared to fulfill it. Emails sent to GoDaddy did not elicit a response until the publishing of this article.