Security and privacy are two of the most important things an Internet based retail shopping website can have since the exchange of personal and financial data are essential to the completion of an Internet retail transaction. A large percentage of Internet shoppers do not research or question a retail website’s privacy or security, but the importance of these two aspects of Internet shopping become crystal clear when a data breach or a privacy invasion occurs.
The primary reason why Internet shopping was not wildly popular at the turn of the 21st century was because of the security fears of potential customers. With the burgeoning mainstream participation in Internet shopping, it seems that security is assumed, and privacy is taken for granted. But just because customers are much less fearful of Internet retailing security and privacy issues, doesn’t mean that they don’t exist.
Each year the Online Trust Alliance (OTA) analyzes the largest retail Internet shopping websites (listed on the Internet 500) for privacy and security best practices, standards, and FTC and National Institute of Standards and Technology compliance. In 2013 that analysis included more than 10,000 web pages and 500 million emails. The analysis was looking for the Internet retail websites that had adopted best practices for these 14 different aspects of security and privacy:
Email Authentication (SPF, DKIM)
Domain-based Message Authentication, Reporting & Conformance (DMARC)
Domain Locking
SSL Server Configuration
Extended Validation SSL Certificates
Always On SSL
Crytopgraphy Certificates
Domain Name System Security Extension
Privacy Policy
Third Party Tracking
Honoring Do Not Track Settings
WHOIS registration
Data Breach & Loss Incidents
Legal Settlements Pertaining to Privacy or Security Issues
Based on their analysis, 38% of the 100 largest retail websites were recognized for for their leading edge privacy and security practices, policies, and technologies and were given a spot on the 2013 OTA Honor Roll. In total, 26% of the 500 largest retail websites were recognized on 2013 Honor Roll.
While it is comforting to Internet shopping customers to know that there are 130 Internet shopping websites that are embracing the highest standards, it is more than a little disconcerting to know that 370 of the largest Internet retail shopping websites are putting the privacy or security of its customers at risk, according to the OTA analysis. Given that the analysis was only conducted on the largest Internet retail websites, these 370 websites can’t really blame their security or privacy vulnerabilities on the lack of resources or lack of access to leading edge privacy and security tools and technologies.
But what should really give Internet shoppers the biggest cause for concern is the fact that 52.8% of the 500 largest Internet retailers not only didn't qualify for the 2013 OTA Honor Roll, they actually received a "failing" rating for at least one key security or privacy factor. According to the OTA, the three most common areas of "failure" for their retail websites were sub-optimal privacy practices, email authentication, and SSL security.
In other words, 370 of the biggest retail shopping websites may be sharing private customer information, vulnerable to email fraud, or receiving personal and financial information from customers that is unencrypted or somehow accessible. The large number of retail website security vulnerabilities identified by the OTA are easy to believe, given the 267 million data records that were exposed in 2,644 reported security and privacy breaches in 2012, according to the OTA.