- FTC completed its orders for Godaddy after security breach
- The orders are part of a agreed solution
- Godaddy has different headings for different operations
The US Federal and Trade Commission (FTC) has outlined almost a dozen requirements that host of provider Godaddy must fulfill to settle the fees for data security errors that resulted in more data violations in recent years.
In a 14-page document, FTC first stated that Godaddy must no longer be wrongly represent its security and data protection practices, use of security technologies or its participation in security and privacy programs (suggests that the company actually misleading users about its security practices).
Godaddy then has 90 days to implement a comprehensive program documented and updated at least once a year (or after an incident) assigns a qualified person who is responsible and assesses and manages internal and external security risks, among other things.
Additional requirements
The hosting giant also has 180 days to disconnect or secure non-supported software and hardware, monitor for unauthorized changes in us and the app files and to create “phishing-resistant multi-factor approval (MFA) for employees, contractors and customers.
Other requirements include third -party security assessments, full cooperation with assessors, annual executive certification, incident reporting and more.
Godaddy is one of the best site hosting companies that serve more than five million customers around the world.
For approx. Two years ago, it was discovered that an unknown threat actor had been in Godaddy’s systems for several years, installed malware, stealing source code and attacking the company’s customers.
The company’s SEC archiving at that time showed that attackers violated Godaddy’s CPanel shared hosting environment and used it as a launch plate for further attacks. The company described the hackers as a “sophisticated threat actor group”.
The group was eventually discovered at the end of 2022, when customers began reporting that traffic coming to their sites was redirected elsewhere.
Via Bleeping computer
