The truth about GoDaddy a strainer company

GoDaddy has not been protecting its web hosting platform with basic infosec tools and practices since 2018, according to the FTC, but the company is not facing any immediate consequences for its omissions.

As one of the largest web hosting companies in the world and a registrar with approximately 82 million domains under its care, one would assume that GoDaddy would be able to implement updates and monitor security-related events in its hosting environment to protect its millions of customers and website visitors from online threats.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

However, according to a Wednesday statement from the FTC,

“GoDaddy failed to implement reasonable and appropriate security measures to protect and monitor its website hosting environments for security threats and misled customers about the extent of data security protections in its hosting services.”

A formal complaint [PDF] against the company, drafted by the federal consumer watchdog, describes the business as “blind to vulnerabilities and threats in its hosting environment” since 2018.

The complaint alleges that the web hosting company fails to properly manage its assets and inventory, fails to patch its software, fails to assess risks to its hosting services, fails to use multi-factor authentication, fails to log security-related events, fails to monitor for threats, and fails to secure connections to services that provide access to consumer data.

“As a result of GoDaddy’s data security failures, it experienced several significant breaches of its hosting service between 2019 and 2022 , during which hackers repeatedly gained access to its customers’ websites and data, causing harm to its customers and putting them and visitors to their websites at risk of further harm,” the complaint states.

The failure to secure its systems makes GoDaddy's "representations about security false or misleading," the FTC claims.

After all of the above, one might assume that the FTC would shut down GoDaddy or charge it with some huge fine, since it repeatedly puts its millions of customers at risk:

No.

Instead, a settlement [PDF] was proposed, approved by FTC commissioners in a bipartisan 5-0 vote, which gives GoDaddy 90 days to create, implement, and maintain “a comprehensive security program.”

GoDaddy, which appears to be happy with this agreement, neither admits nor denies any of the allegations in the FTC complaint.

giorgos

George is still wondering what he is doing here….