# FTC To GoDaddy: Heal Thyself

- Link: https://www.agilicus.com/ftc-to-godaddy-heal-thyself/
- Published: 2025-01-18T18:25:01+00:00
- Author: Don Bowman

The US Federal Trade Commission [issued](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-takes-action-against-godaddy-alleged-lax-data-security-its-website-hosting-services)
an order to GoDaddy to implement robust information security practices, extending
the techniques the government is using to improve cyber security in a broad-based
fashion.

[GoDaddy](https://www.godaddy.com/) is not (yet) in a regulated industry, supplying
DNS, web hosting and related services. In the [complaint](https://www.ftc.gov/system/files/ftc_gov/pdf/2023133_godaddy_complaint.pdf),
the FTC indicates that: “_GoDaddy’s data security program was unreasonable for a
company of its size and complexity. Despite its representations, GoDaddy was blind
to vulnerabilities and threats in its hosting environment. Since 2018, GoDaddy has
violated Section 5 of the FTC Act by failing to implement standard security tools
and practices to protect the environment where it hosts customers’ websites and 
data, and to monitor it for security threats._ … _As a result of GoDaddy’s data 
security failures, it experienced several major compromises of its hosting service
between 2019 and December 2022, in which threat actors repeatedly gained access 
to its customers’ websites and data_“.

This is a relatively new tactic being employed to increase the base level of security
in otherwise unrelated areas. We have seen actions, threats, fines, against equipment
manufacturers (e.g. [D-Link](https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3157-x170030-d-link),
[TP-Link](https://www.wsj.com/politics/national-security/us-ban-china-router-tp-link-systems-7d7507e6?utm_source=agilicus.com)),
but this marks an expansion in the supply chain regarding securing small business.

> Proposed order will prohibit GoDaddy from misleading customers about its security
> protections and require it to establish a robust information security program

A parallel government agency, the SEC, introduced new [rules](https://www.sec.gov/newsroom/press-releases/2023-139)
for disclosure and management of cyber security, introducing another push in the
supply chain improvement of cyber security practices. This implies that there is
a ‘full court press’ underway to improve cyber security at all levels, equipment,
supplier, practices, large, small, etc.

In the case of GoDaddy, they have a very large market position, and, are directly
or indirectly responsible for a large amount of risk in 62 million domains, 21 million
customers. Consider the humble DNS. If i can alter/add records to your DNS, I can(
this is not a comprehensive list!):

 * take over your Microsoft Azure of Google Workspace setup
 * Enable email sending as you via SPF, DKIM (and thus e.g. Business Email Compromise
   to your suppliers or customers)
 * Remove visibility to spoofing your email via DMARC
 * Issues SSL certificates in your name via CAA and HTTP-01 or DNS-01 challenge
 * Read your email via changing your MX record, and thus take over most of your 
   online accounts via a ‘password reset -> email flow’
 * Inject malware into your e-commerce website to steal credit card info (via an
   AiTM proxy and the above SSL)

I would hazard a guess that most companies didn’t consider the ‘website hosting’
as a key part of their security and risk posture. Its a cornerstone pillar, an unlimited
skeleton key to all your locks, all your SaaS, all your online activities, the security
of your supply chain, etc.

Defence in Depth: its not just for others, look up and down your supply chain.