Action against GoDaddy over security practices — FTC takes

Consent agreement will require GoDaddy to improve security practices and not mislead clients.

The Federal Trade Commission is admonishing GoDaddy (NYSE: GDDY) for lax security practices in its hosting business.

In a complaint (pdf), the FTC stated that GoDaddy “has marketed itself as a secure choice for clients to host their websites, touting its commitment to data security and careful threat monitoring practices in multiple locations, counting its main website for hosting services, its “Trust Center,” and in email and online marketing.”

Still, the FTC stated that GoDaddy’s security fell far short of its promises.

In fact, GoDaddy’s data security program was unreasonable for a firm of its size and complexity. Despite its representations, GoDaddy was blind to vulnerabilities and threats in its hosting environment. Since 2018, GoDaddy has violated Section 5 of the FTC Act by failing to implement standard security tools and practices to protect the environment where it hosts clients’ websites and data, and to monitor it for security threats. In particular, GoDaddy failed to: (a) inventory and manage assets; (b) manage software updates; (c) assess risks to its website hosting services; (d) use multi-factor authentication; (e) log security-related events; (f) monitor for security threats, counting by failing to use software that could actively detect threats from its many logs, and failing to use file integrity monitoring; (g) segment its network; and (h) secure connections to services that provide access to consumer data. These failures made GoDaddy’s representations regarding security false or misleading.

The FTC cites breaches that occurred between 2019 and 2022.

GoDaddy intends to submit to a consent agreement with the FTC that will:

• Prohibit GoDaddy from making misrepresentations regarding its security and the extent to which it complies with any privacy or security program sponsored by a government, self-regulatory, or standard-setting organization, counting the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks;
• Require GoDaddy to establish and implement a comprehensive information-security program that protects the security, confidentiality, and integrity of its website-hosting services; and
• Mandate that GoDaddy hire an independent third-party assessor who conducts an initial and biennial review of its information-security program.