►
From YouTube: 2018 Online Trust Audit & Honor Roll Webinar
Description
The Internet Society’s Online Trust Audit & Honor Roll recognizes excellence in online consumer protection, data security, and privacy practices. This 10th annual audit of more than 1,200 predominantly consumer-facing websites is the largest undertaken by OTA, and was expanded this year to include payment services, video streaming, sports sites, and healthcare.
What did we learn? On Wednesday 24 April 2019 join the Internet Society and Audit sponsor (and Honor Roll recipient) Symantec for a discussion about the Audit results, overall trends in privacy and security, and the best practices that can improve their security and privacy posture.
https://www.internetsociety.org/events/ota-honor-roll-webinar/
SPEAKERS
Jeff Wilbur, Technical Director, Online Trust Alliance, Internet Society
Kenneth Olmstead, Internet Security & Privacy Analyst, Internet Society
Neil Daswani, Senior Vice President, Consumer Chief Information Security Officer, Norton LifeLock
OTA 2018 ONLINE TRUST AUDIT & HONOR ROLL RECAP VIDEO https://youtu.be/efTbg5krfpw
FULL REPORT: https://otalliance.org/system/files/files/resource/documents/2018-ota-audit-final_0.pdf
MORE INFO: https://otalliance.org/2018HonorRoll
TWITTER
#OTATrustAuditHonorRoll http://bit.ly/otatrust
ABOUT ONLINE TRUST ALLIANCE
The Online Trust Alliance is a non-profit with the mission to enhance online trust, empower users, and promote the innovation and vitality of the Internet. Visit: https://otalliance.org
A
Hello,
everyone
and
welcome
to
the
webinar
we're
going
to
review
the
results
of
our
2018
online
trust,
audit
and
honor
roll.
Our
panelists
today
are
myself
I'm
the
technical
director
of
the
online
trust
Alliance
initiative
at
the
Internet
Society,
we're
happy
to
have
with
us
Neil.
The
swanee
is
senior
vice
president
and
chief
information,
security
officer
for
the
consumer
business
unit
at
Norton,
LifeLock
or
Symantec
overall
and
Kenny
Olmstead
who's,
also
on
the
OTA
team.
Here
as
an
Internet
security
and
privacy,
analyst
we're
gonna
cover
different
pieces.
A
Kenny
and
I
did
most
of
the
work
and
analysis
here.
So
we're
gonna
cover
the
sections
that
we
did
and
Neil
has
been
associated
with
the
audit
for
many
years
now
and
is
a
practitioner
of
security
and
many
different
companies.
So
he
can
lend
that
perspective
to
us.
So
that's
gonna
be
great,
so
just
to
give
you
an
overview.
This
is
our
tenth
annual
audit
so
started
many
years
ago,
and
it's
transformed
over
time.
A
The
high
level
objectives
we
have
for
this
audit
are
to
drive
awareness
of
different
best
practices
and
principles
that
enterprises
that
attach
to
the
Internet
should
be
implementing
and
deploying,
and
also
to
move
companies
and
organizations
from
a
mindset
of
compliance.
What's
the
minimum
I
have
to
do
to
stewardship.
What's
the
right
thing
to
do
and
that's
very
important
and
we
set
up
our
criteria
that
way
it
often
goes
beyond
the
kind
of
legal
compliance
that
you
see
out
there.
We
want
all
these
organizations
to
continually
monitor
and
improve
their
practices
across
the
board.
A
This
is
a
pretty
comprehensive
audit,
you'll
see
and
then,
with
our
honor
role.
We
recognize
leadership
in
excellence,
so
we
do
that
every
year
as
well.
Just
to
give
you
a
sense
of
what
we
do
in
this
audit
and
it
really
hasn't
changed
for
the
last
several
years.
Now
we
assess
different
industry
sectors
and
we
choose
those
sectors,
and
then
we
define
the
members
of
those
sectors
by
some
list
that
we
can
find
out
there,
whether
it's
ranked
by
revenue
or
ranked
by
traffic,
ranked
by
assets
in
the
case
of
banks.
A
So
we
go
to
sources
some
in
some
cases
like
the
consumer
services
sector,
we
kind
of
build
our
own.
It's
made
up
of
sub
sectors
of
things
like
travel,
dating
social
networks,
job
sites,
free
tax,
filing
sites,
video
streaming,
there's
a
whole
bunch
of
sub
sectors
within
that,
and
you
can
see
the
major
sectors
that
we
cover
there.
So
it's
more
than
1,100
organizations
that
Healthcare
is
new
this
year,
so
we
usually
add
a
new
sector
every
year
or
two
as
we
look
around
and
see
what
deserves
to
be
kind
of
a
closer
look.
A
So
it's
kind
of
like
an
ad
on
a
roll
in
the
US
and
have
no
failures
and
our
failure
bar
is
at
60%.
So
if
you
do
great
and
consumer
protection
and
security,
but
your
privacy
score
is
55,
you
will
fail
that
category
and
therefore
fail
beyond
it,
so
you're
only
as
strong
as
your
weakest
link,
so
that's
kind
of
how
we
do
it.
A
That's
fantastic!
Every
year
we
changed
the
methodology
to
kind
of
reflect
best
practices
that
are
going
and
new
attacks
that
happen
out
there
in
the
world.
So
the
bar
is
raised
every
year
in
one
way
or
another,
usually
across
all
the
categories.
So
to
see
such
a
jump
in
on
a
real
achievement,
even
as
the
bar
is
raising,
is
a
great
achievement.
We
would
love
it
if
everyone
made
the
honor
roll.
That
means
they're
all
doing
things
really
well.
A
In
this
case,
it
was
primarily
due
to
improvement
in
email,
authentication
and
we'll
look
at
that
more
closely
in
a
minute,
but
before
we
go
on,
I
wanted
to
Neil
has
been
associated
across
several
companies
with
this
audit
for
many
years
now,
and
you
know,
I
just
wanted
to
get
a
sense
from
you.
What
have
you
found
valuable
and
kind
of
how
we
look
at
things
and
assess
organizations
with
this
audit
thanks.
B
You
know,
as
you
mentioned,
I've
been
having
I've,
had
the
privilege
to
work
together
with
the
online
trust
Alliance
back
since
2010,
when
I
was
at
des
siient
a
company
that
I
co-founded
post
being
at
Google
and
have
followed
the
online
trust
Alliance
through
my
time
at
Twitter
life
block
and
now
Symantec,
and
it's
been
great
to
see
that
you
know
under
Bob's
Lords
leadership.
He
was
the
sees
all
the
time
at
Twitter.
Twitter
was
able
to
get
to
number
one
back
in
2013
or
2014,
and
I
was
glad
that
life
walk
achieved.
B
Number
one
in
the
consumer
sector
back
in
2017.
I.
Think
that
if
we
look
at
the
kinds
of
countermeasures
that
the
online
trying
trust
Alliance
looks
at
it's
a
set
of
competitors
that
are
above
the
minimum
bar
sorts
of
things
that
you
need
to
do
when
you
get
assessed
as
a
PCI
compliant
vendor.
Or
if
you
look
at
ISO
27000,
there's
a
lot
of
minimum
bar
sorts
of
things.
So
it's
you
know
really
great.
B
A
A
Where
the
to
the
upper
right
there
is
the
US
government
which
I'm
not
mistaken,
only
had
a
few
in
the
top
50
last
time
and
they
they
made
great
strides,
we'll
see
in
a
minute
and
had
many
in
the
top
50
this
time.
The
lower
left
of
that
is
the
consumer
sector.
They
have,
since
we
added
them
to
the
list,
been
the
leaders
and
pretty
much
everything
with
new
infrastructure.
Doing
the
latest
things
and
again
they
lead
in
this
scoring
in
the
top
50,
with
all
the
the
companies
you
see
here,
the
middle
right.
A
A
So
in
the
healthcare
sector,
I
didn't
mention
this
before
it's
actually
made
up
of
four
sub-sectors:
its
top
testing
medical
testing
labs,
which
23andme
would
would
be
a
part
of
that
top
pharmacies,
top
insurance
companies,
health
insurance
companies
and
hospital
chains,
so
there's
kind
of
four
pieces
within
those
hundred
organizations.
This
is
our
top
fifty
and
we're
glad
to
see
this,
and
we
hope
that
everyone
aspires
to
to
do
this
and
actually
to
get
in
the
top.
A
Fifty
this
year,
you
had
this
for
more
than
a
hundred
percent,
so
we'll
see
how
that
that
works
later,
because
you
can
earn
extra
credit
points
for
various
things.
Alright,
so
now
I'm
going
to
look
at
trends
by
sector
and
again
this
only
goes
back
kind
of
a
four
year
snapshot.
We
do
have
data
going
back
further,
but
you
can
see
that
generally
in
those
sectors,
it's
kind
of
up
into
the
right
year
by
year.
A
In
our
last
audit,
we
had
two
that
fell.
Banks
fell
significantly
from
fifty
five
percent
to
twenty
seven
and
the
federal
government
fell
a
bit
from
46
to
thirty-nine,
both
of
them
rebounded
wonderfully
from
last
time.
To
this
time,
the
banks
more
than
recovered
and
are
back
on
that
kind
of
up
into
the
right
movement,
the
federal
government
actually
by
far
exceeded
that
and
became
the
top
sector
for
the
first
time
ever,
the
consumer
sector
has
always
been
our
top
honor
roll
achiever.
So
congratulations
to
the
federal
government.
A
They
did
it
mainly
through
email,
authentication,
implementation
that
was
kind
of
their
weak
point
in
the
past
and
that
we're
also
glad
to
see
the
news
and
media
sites.
We
first
assessed
them
actually
2014,
so
they
had
a
4%
honorable.
Then
they
went
8,
23,
48
and
now
78.
That's
nearly
geometric
growth
and
we're
just
really
glad
to
see
that
that
continued
improvement
and
they've
improved
in
all
areas
and
privacy
and
site
security
and
and
the
kind
of
consumer
protection
or
email
authentication
area
is
peace
and
host
was
new
last
year.
A
A
One
of
the
other
things
we
look
at
is
the
kind
of
range
and
median
because
you
get
high
scores
in
a
sector
and
you
also
get
very
low
scores.
So
this
kind
of
represents
that
the
yellow
bar
is
is
the
range
and
the
blue
bar
is
the
median
score
for
many
years.
We
had
that
blue
median
hovering
right
at
that.
Eighty
mark-
and
this
is
kind
of
the
overall
score
on
a
normalized
scale
from
you
know,
zero
to
100.
A
There
was
at
least
one
organization
that
earned
something
over
a
hundred
percent
and
that's
due
to
bonus
points
and
we'll
look
at
where
those
come
from
as
we
look
into
each
of
those
three
different
categories
that
we
cover.
It's
also
useful
to
look
at
the
flip
side
of
this.
So
we
looked
at
the
good
honor
roll,
the
top
scores.
It's
also
good
to
look
at.
A
Why
did
they
fail
or
where
they
doing
poorly
and
as
I
mentioned
before,
if
you're
under
a
sixty
out
of
a
hundred
and
any
one
of
these
three
broad
categories,
you
fail
and
therefore
fail
the
honor
roll.
So
you
can
see
that
by
sector
how
the
different
companies
are
doing
so
in
consumer
protection
and
that
the
kind
of
tan
colored
bar
on
the
right
hand,
side
of
each
of
these
clusters
is
the
overall
average.
A
So
13
percent
of
sites
failed
due
to
consumer
protection,
mainly
email
authentication,
you
can
see
it
varies
quite
a
bit
from
almost
none
and
the
top
retailers
to
35
percent
of
healthcare
sites.
So
that's
their
Achilles
heel
is
email,
authentication,
something
to
work
on
in
site
security.
You
can
see
that
the
overall
average
is
only
3
percent,
which
is
great
and
actually
the
top.
A
Retailers
are
the
weakest,
but
all
those
scores
are
pretty
strong
and
we
had
no
failures
actually
in
federal
sites
and
the
new
sites
for
the
first
time
in
site
security,
and
then
you
can
see
on
the
right
there
and
privacy
overall
15%
failed
due
to
privacy
led
by
the
retailers
and
then
followed
by
the
ISP
in
host
category,
and
then
you
can
see
the
others
again
a
pretty
wide
range.
There.
I
should
note
that
we
separate
the
internet,
retail
or
100
and
500
it's
really.
A
A
So
we
use
that
report
as
our
source
and
but
we've
always
compared
the
100
to
the
500
to
see
if
there
are
any
variances
between
the
really
big
retailers
and
the
next
400,
and
so
that's
why
we
we
cover
that
this
way
so
27,
if
you
add
that
all
up
their
their
sites,
that
failed
in
more
than
one
category
like
they
might
have
failed
in
both
site
security
and
privacy.
Only
three
percent
failed
in
more
than
one
category
and
so
actually
I
think
the
last
time
it
was
12
or
so
percent
that
failed.
A
Yeah
I
just
had
a
lightning
hit
at
my
house
and
I
didn't
know
if
I
was
still
home,
I'm
sorry
so
anyway,
then.
The
other
thing
we
look
at
is
the
ratio
of
how
many
make
the
honor
roll
versus.
How
many
have
a
failure-
and
you
can
see
and
how
many
are
in
between
you-
can
see
that
the
slice
between
the
two
is
very
narrow
and
in
fact,
in
some
cases
there
are
none
in
between
it's
either
on
a
roll
or
fail,
and
nothing
in
between.
A
So
you
know,
look
at
banks
are
a
case
of
that.
The
health
care
sector
was
the
case
of
that
overall.
Only
3%
kind
of
live
in
that
sort
of
see
student
range
again.
If
we
think
of
school
scoring
so
Neil
I
know.
You
also
had
a
comment
on
just
overall
trends
that
that
you've
seen
in
in
this
having
been
associated
with
this
audit
over
the
years.
B
Short
thanks
for
asking
me
to
weigh
in
on
that
I
think
from
a
conversation
that
we
had
earlier.
I
had
asked
the
question
hey
when,
when
the
online
trust
Alliance
on
it
all
had
first
started
ten
years
ago,
what
percentage
of
organizations
made
the
honor,
roll
and
I
think
you
mentioned
to
me
that
it
was
8%
and
so
I
think
it
is
remarkable
that
over
the
past
10
years
now,
when
we
look
I
guess
across
all
categories,
70%
make
it
to
the
point
that
the
AMA
intro
Alliance
has
had
to
come
up
with
additional
designations.
B
Now,
like
top
of
the
class
which
I
think
50
out
of
you,
know
the
11
or
12
hundred
and
now
make
it.
So
you
know
if
we
think
back
to
a
grade
school
or
college,
and
we
think
about
what
does
it
mean
to
you
know,
make
an
honor
roll
and
what
does
it
mean
to
be
at
the
top
of
the
class?
It's
interesting
that
you
know
the
top
of
class
is
now
you
know
the
top
5%,
it's
just
great
to
see
so
many
organizations
having
adopted
more
and
more
of
the
countermeasures
and
the
privacy
practices.
B
B
But
when
some
of
these
countermeasure
disciplines
and
these
privacy
practices
are
not
there,
they
are
inevitably
surprised,
and
so
it's
been
great
to
see
that
the
online
trust
Alliance
has
also
been
increased
in
the
bar,
as
we've
been
going
along
and
we
are
now
seeing
organizations
70%
of
them
hit
the
Honor
Roll.
So
I
thought
those
were
pretty
remarkable
trends
and
you
know
look
forward
to
seeing
other
sectors
catch
up
with
the
federal
government
and
and
with
the
consumer
sector
as
well.
Great.
A
So
we're
going
to
move
on
and
peel
into
each
of
these
areas
specifically
and
look
at
a
little
more
detail
so
in
the
consumer
protection
area.
The
decoder
ring
here
is
that
the
top
section,
the
kind
of
neutral
color,
is
the
baseline
points.
The
kind
of
greenish
section
is
the
bonus
that
you
can
earn
that
it's
so
associated
with
this
and
the
bottom,
the
kind
of
brick
color
there
is
penalty
points,
so
the
baseline
points
are
entirely
made
up
of
email
authentication.
A
So
we
look
for
the
two
email,
authentication,
technologies,
SPF
and
DKIM-
definitely
at
the
top-level
domains
for
a
foreign
organization
and
then
subdomains
where
they
can
get
used.
Also
Demark,
which
is
another
technology
that
gets
used
to
you,
can
get
reports
on
your
email
authentication
and
also
assert
a
policy
that,
if
a
message
fails
authentication
what
so
that
should
the
receiver
do
with
it.
It's
been
in
place
five
or
six
years
now,
and
it's
been
pretty
well
adopted.
Anything
in
italics
here
is
what
shifted
from
the
last
audit
to
this
audit.
A
So
in
this
case,
we
put
a
little
more
weight
on
SPF
and
DKIM.
At
the
top
level,
we
put
a
little
less
weight
on
subdomain
use
of
Demark.
We
put
a
little
extra
weight
on
reject
policy,
which
means
throw
away
messages
that
don't
pass
authentication
for
Demark.
Looking
at
the
bonus
points,
you
can
encrypt
email
between
email
servers.
It's
called
opportunistic
TLS,
where
the
servers
themselves
negotiate
that
we
increase
the
weight
on
that
this
year.
Dns,
SEC
and
ipv6
are
part
of
that
as
well
for
bonus
points
and
then
a
penalty.
A
If
you
don't
lock
your
domain
administrative
Lea,
meaning
someone
could
kind
of
come
in
and
take
over
your
domain
administrative
Lea.
So
that's
the
the
set
up
we
use
for
the
for
the
baseline
bonus
and
penalty
points.
You'll
see
a
similar
discussion
than
the
other
two
categories,
but
looking
at
the
data
that
we
found,
in
fact,
OTA
was
kind
of
founded
on
email
authentication.
That
was
the
first
assessment.
We
did.
A
We
called
them
score
cards
back
in
O
5
when
we
first
started
so
we've
been
tracking
this
for
a
long
time
and
the
two
main
technologies
SPF
at
the
top-level
domain,
D
came
at
the
top-level
domain.
You
can
see
that
SPF
is,
you
know
up
near
the
90%
range
overall
D
Kim
actually
made
some
pretty
big
leaps
this
year,
which
is
see
there.
A
There
are
two
complementary
technologies
that
are
done
very
differently,
but
they
can
they
each
cover
kind
of
edge
cases
that
using
them
in
conjunction
with
with
each
other,
is
a
best
practice
to
protect
email
and
allow
recipients
to
verify
that
the
email
is
really
from
you.
We
also
track
SPF
and
DKIM
any
that
means
at
a
top
level
or
sub
domain.
Often
subdomains
are
delegated
out
to
marketing
companies,
for
instance
or
others.
So
we
see
a
much
higher
adoption
rate
there,
because
those
professional
email
senders
usually
do
implement
all
the
email
authentication
technologies.
A
That's
why
you
see
it
up
in
the
high
90s
in
almost
every
sector,
even
though
these
numbers
are
high
and
they're,
probably
one
of
the
highest,
we
see
across
all
these
different
categories.
There's
still
room
to
grow,
there's
still
17%
of
the
organizations.
Don't
do
D
Kim
at
the
top
level
and
11%
don't
do
it
with
SPF.
A
So
it's
important
one
of
the
things
we
instituted
a
couple
years
ago
was
looking
at
actually
the
validity
of
some
of
these.
So
you
can
post
a
record
that
looks
like
you're
good,
but
when
you
analyze
that
it
actually
is
ineffective,
it's
invalid.
For
some
reason,
the
syntax
error
points
to
the
wrong
place.
That
kind
of
thing.
So
now
we
invalidate
those
depending
on
the
error.
Sometimes
it
reduces
your
points
and
so
yeah
Neal.
Oh.
A
So
sometimes
we
invalidate
those
completely.
Sometimes
we
don't,
but
we
just
deduct
from
the
score,
but
we're
as
every
year
goes
on,
we
kind
of
peel
deeper
into.
Not
only
are
you
doing
it,
but
are
you
doing
it
well
and
that's
the
the
case
across
most
of
these
criteria
that
we
use
looking
very
quickly
the
table
with
a
lot
of
data
in
it
just
want
to
point
out
the
trend
over
time
by
sector.
We
saw
some
pretty
big
jumps
from
the
last
SATA
to
this
audit
in
the
federal
government,
especially
more
than
doubled
from
46%.
A
You
can
see
here
in
that
the
rightmost
part
of
the
left
chart,
but
it
does
vary
a
lot
from
pretty
low
for
the
500
retailers
to
extremely
high
for
the
federal
government
at
93%,
and
then
the
d
mark
RQ
means
you've
set
a
policy
statement.
I
want
you
to
either
reject
messages
that
aren't
authenticated
or
quarantine
them
kind
of
junk,
folder
type
thing,
and
you
can
see
if
the
federal
government
is
by
far
the
leader
in
both
of
these
followed
by
the
consumer
sector,
which
had
previously
been
the
leader.
A
A
lot
of
this
is
due
to
a
directive
that
came
out
in
late
2017
for
federal
government
agencies
to
implement
email,
authentication
and
encryption
on
their
websites,
and
they
followed
it
very
closely.
As
you
can
tell
so.
The
numbers
are
very,
very
high
again
a
lot
of
data
here,
but
just
pointing
out
some
highlights
between
2017
and
2018,
so
huge
huge
jump
in
the
federal
government
from
20%
had
a
record
last
time
to
93%.
Now,
that's
that's
a
great
jump
and
then
the
banks
had
a
great
jump
as
well
from
39
to
70
other
sectors.
A
They
all
grew,
maybe
not
quite
as
dramatically
and
then
in
the
enforcement
as
it's
called
using
the
policy
of
reject
or
quarantine.
We
also
saw
some
jumps
in
both
the
federal
government
and
the
consumer.
100
and-
and
these
are
these
are
significant
jumps
from
year
to
year,
especially
in
the
enforcement,
as
well
as
for
the
government.
B
Yes,
Jeff.
In
fact,
one
of
the
things
that
I
did
find
surprising
is
that,
while
there
looks
like
there's
been
more
and
more
organization
signing
their
outgoing
emails
using
the
dickham,
the
domainkeys
identified
mail
standard
that
you
talked
about
and
some
of
these
rates
are
getting
to
the
SE,
70s
or
80s.
I'm
surprised
that
they're
not
at
say
95
percent
or
more.
B
The
fact
that
the
D
Kim
standard
exists
and
that
you
can
have
your
organization's
have
signed
outgoing
mills
it'd
be
great
to
see
that
at
you
know,
95
percent
or
above
what
we've
been
seeing
is
that
phishing
is
still
a
major
threat
where
attackers
are
impersonating
emails
in
any
attack
or
in
any
sort
of
were
going
after.
Communication
is
one
of
the
first
thing
that
attackers
do
so
if
we
can
have
more
and
more
organizations
signing
their
emails,
digitally
signing
their
emails
using
the
D
Kim
standard.
B
Even
if
you
don't
have
a
dimeric
enforcement
record
deployed
yet
I
think
it
would
be.
You
know
great
to
be
at
that
point,
so
it
was.
It
is
great
that
we
got
to
the
progress
level,
the
70s
and
80s,
but
I
was
kind
of
surprised
that
the
sighting
hasn't
caught
up
to
the
level
of
corruption
going
on
email
be
great
to
see
that
as
a
as
it
next
up
for
the
industry,
yeah.
A
It's
a
great
point
and
we
continually
hear
that
you
know
attacks
are
90%
or
so
initiated
via
email.
So
this
is
the
area
to
protect
first
and
goes
along
with
what
you
were
saying
and
even
though
we
did
see
a
big
leap,
especially
in
Deakin,
there
definitely
is
room
to
grow
there.
So,
let's
move
on
to
site
security,
a
similar
kind
of
structure
here,
the
baseline
points
are
mainly
revolve
around
your
SSL
and
TLS
implementation.
So
have
you
done
it?
A
Well,
there
are
ways
you
can
configure
combinations
of
protocols
and
ciphers
and
things
that
expose
you
to
known
vulnerabilities.
So
there
are
a
couple
free
tools.
We
use
to
assess
that.
Then
we
have
kind
of
a
weighted
blend
that
makes
up
some
of
the
rest
of
the
score
that
covers
application
and
network
security,
IP
reputation
and
whether
your
your
software
apps
are
are
patched
and
we
put
increased
weight
on
those
this
year.
A
Encrypting
the
entire
web
session
from
the
beginning
is
something
that
used
to
be
a
bonus.
We
roll
it
into
baseline
this
year
and
so
that
kind
of
affected
the
the
score.
Fortunately,
it
was
a
very
high
adoption
rate,
so
it
was
a
positive
effect.
The
bonus
points
are
using
extended
validation
certificates,
which
give
you
some
kind
of
indicator
in
the
browser
bar
used
to
be
a
bright
green
bar.
A
Now
the
browser's
doing
it
differently,
but
it
does
give
you
an
indicator
whether
you
use
a
Web
Application
Firewall,
whether
you
have
a
way
to
report
vulnerabilities
on
your
site
and
whether
you're
implementing
certificate
authority,
authorization
I'll
talk
about
that
a
moment
and
then
penalties.
If
we
find
vulnerabilities
or
malware
on
the
site
and
we
have
different
tools,
we
use
to
scan
that
so
looking
at
the
scores,
the
baseline
scores
are
all
hovering
around
90
average
89.
A
The
adoption
of
always-on,
SSL
and
other
term
used
for
that
encrypting.
The
web
sessions
entirely
that
jumped
significantly
from
the
low
50s
to
the
low
90s
just
in
one
audit
cycle,
and
so
we're
very
glad
to
see
that
that's
something
we've
been
advocating
for
for
long
time
so
great
to
see
that
and
that's
part
of
the
reason
we
made
it
part
of
baseline
scoring
is
because
it
has
become
a
well
adopted
best
practice.
Use
of
the
extended
validation
certificates
is
still
very
sector
dependent
averages.
A
25%,
the
banks
are
the
ones
who
use
it
the
most
they
were
the
first
ones
to
adopt
it
widely
back
when
it
was
introduced,
so
that
you
knew
you
were
on
the
bank's
side
and
not
some
other
fishing
site.
But
you
can
see
that
you
know
a
lot
of
the
sectors
are
in
that
25%
average
range
some
are
lower
and
then
the
banks
are
kind
of
a
spike
there.
A
Caa
is
is
a
way
that
companies
can
broadcast
to
the
issuers
of
these
certificates,
who
they
get
their
certificates
from,
and
so
they
can
put
on
their
site.
I
get
it
from
these
specific
certificate
authorities,
and
that
way,
if
there's
a
certificate
authority
who
is
asked
to
do
a
certificate
who's
not
on
that
list,
they
wouldn't
issue
it
and
it's
a
way
to
prevent
fraudulent
activity
in
terms
of
issuing
certificates.
It
was
mandated
for
all
the
certificate
authorities
by
the
see
a
browser
forum
to
go
into
effect.
A
Last
fall
in
the
fall
of
2018
companies
themselves
are
not
obligated
to
do
it,
but
it's
an
opportunity
for
them
to
kind
of
close
down
a
loophole
if
they
wish
and
we
actually
rolled
it
into
the
scoring
this
year,
knowing
that
it
had
been
mandated
by
the
see
a
browser
forum
and
it's
it's
got
fairly
low
adoption
so
far,
but
we'll
keep
tracking
it.
The
consumer
sector
is
the
highest.
A
These
are
screenshots
of
some
of
the
tools
that
we
use.
The
top
left
and
top
middle
are
the
two
that
we
blend
together
for
the
ssl/tls
assessment
aspect
and
that's
the
heaviest
part
of
the
scoring
for
a
baseline.
These
are
all
for
a
TA
zone,
site
I
think
done
this
morning,
so
we
have
an
a
for
both
of
those.
But
if
you,
if
you
scroll
down
in
these
reports,
they
give
you
a
lot
more
detail,
they
give
you
you
can
click
through
on
things
of
how
to
address.
A
If
something
is
causing
you
a
low
letter
grade,
how
can
you
remedy
that
so
they're
great
tools
and
they
keep
pace
with
all
the
stuff?
That's
going
on
in
the
world?
The
two
on
the
right,
the
upper
and
lower
our
web
security
focus,
so
these
are
headers
in
your
web
security.
Http
interaction,
immuno
web
has
one
just
like
they
have
one
for
the
SSL
test
and
we
scored
a
b-plus
and
then
this
year
we
also
use
Mozilla's
observatory
when
we
got
a
d-minus
and
that
sounds
really
low.
A
One
of
the
comments
we
often
say
is
that
in
this
business,
if
you're
standing
still
you're
falling
behind,
because
the
bad
guys
are
continuing
to
improve
their
attack
methods,
and
so
these
tools
I'll
keep
track
with
that
and
a
fairly
fast
pace,
so
that
using
these
regularly
can
keep
you
on
top
of
things.
The
other
area
that
we
started
talking
about
a
few
audits,
agos,
vulnerability,
reporting
and
it's
still
very
low,
and
it's
adoption
almost
double
this
year,
but
it's
still
only
at
just
in
11%.
The
consumer
sector
has
adopted
it
the
most
broadly.
A
Then
you
can
see
the
others.
We
implemented
an
OTA,
a
vulnerability
reporting
form
a
very
simple
one.
A
few
years
ago
there
are
third-party
programs
available,
bugcrowd
and
hacker
one
or
the
two
most
prevalent
that
we
see
but
neo
I
know.
You
know
when
I
talked
to
you
about
what
what
are
easy
things.
People
should
be
doing
that
they
aren't.
This
is
one
of
the
things
you
answered
immediately
submit.
Why
don't
you
talk
about
that
sure?
Let.
B
Me
comment
on
that.
So
I
think
that
setting
up
a
page
like
this,
where
security,
researchers
and
others
can
report
vulnerabilities
is
just
you
know,
a
very
smart
awesome
thing
do
if
you
think
about
it,
and
somebody
identifies
a
vulnerability
on
on
your
site,
it's
much
better
for
them
to
have
a
place
to
report.
B
It
then
not
simply
because
you
know,
if
they're,
if
they're,
not
gonna
report
in
that
are
gonna
use
the
vulnerability
or,
if
they're,
going
to
go
straight
to
the
press
with
it,
it's
just
much
better
for
them
of
a
dedicated
place
that
they
could
go
to.
I.
Think
that,
given
that
there's
also,
as
you
mentioned,
companies
that
can
help
run
these
kinds
of
programs
so
much
better
great
sets
of
programs
to
adopt,
in
addition
to
bugcrowd
and
a
hacker
one
Cenac
is
also
another
one.
There's
a
number
of
others
as
well.
B
That
you
know
for
those
sets
of
folks
that
are
gonna
report
it.
It's
just
you
know
good,
to
have
this
kind
of
a
resource
worth
getting
it
set
up.
I
think
the
we
were
talking
about
easy
versus
hard
I
think
the
hard
part
of
this
is
just
making
sure
that
an
organization
is
set
up
to
respond
in
a
timely
fashion
to
any
reports
that
come
in.
B
So
when
we're
talking
about
easy
everything
isn't
completely
easy,
but
given
that
these
kinds
of
reports
could
come
in
any
time,
it's
just
you
know
well
worth
it
to
spend
the
work
to
also
get
your
organization
set
up
to
be
able
to
respond
to
vulnerabilities
in
timely
fashion.
So
thanks
for
asking
for
the
AB
on
that
yeah.
A
Absolutely,
and
that
last
thing
you
said
it's
a
great
point:
it
might
be
easy
to
gather
the
data,
but
if
you
don't
have
a
process
internally
to
process
it
and
actually
respond
to
it,
then
you're
still
failing.
So
it's
important
to
look
at
it
all
the
way
through,
and
this
is
an
area
that
you
know
we're
gonna
continue
to
focus
on,
and
you
hear
you
hear
stories
about
it.
Researchers
find
problems.
A
They
want
to
responsibly
report
that
to
the
company,
if
they
don't,
then
often
they're
forced
to
go
public
with
it
and
that
usually
does
not
work
out
well
for
anyone.
So
setting
this
up
is
a
important
thing
to
do
so.
Let's
move
on
to
privacy,
looking
at
the
scoring
here,
similar
set
up
the
baseline
points
of
100
are
broken
into
two
pieces.
A
55
of
the
points
are
for
the
privacy
policy
of
the
privacy
statement,
as
we
called
it
in
the
report.
45
points
are
for
third-party
trackers
on
your
site,
so
in
the
case
of
the
privacy
statement,
you
you
start
at
zero
and
you
earn
points
by
doing
the
things
listed
here
that
you,
you
have
good
language
about.
Not
sharing
data
about
how
you're
going
to
retain
data,
how
you're
going
to
share
with
third
parties,
you
layer,
your
notices
that
makes
them
easier
to
read,
there's
an
easy.
It's
easy
to
find
from
your
home
page.
A
You
put
a
date
stamp
there.
So
people
know
how
current
it
is,
and
this
year
we
rolled
in
as
a
baseline
from
prior
bonus
points,
whether
you
have
access
to
a
prior
version,
so
people
can
see
what
changed.
That's
a
transparency
issue
as
well
on
third-party
trackers.
You
actually
start
with
45
points,
and
then
you
get
deductions.
If
you
have
for
the
trackers,
you
have
that
shared
data
with
other
third
parties,
so
some
are
used
for
analytics
and
you
pretty
benign,
but
those
who
then
share
kind
of
the
data
domino
effect
with
others.
A
We
we
did
duck
points.
So
that's
how
the
baseline
scoring
works.
You
get.
Bonuses
for
use
of
icons
again
makes
it
easier
to
kind
of
navigate
for
disclosing
across
device
tracking
for
honoring
do-not-track
and
having
a
multilingual
policy
for
having
a
tag
management
solution.
So
the
tags
are
these
third-party
trackers.
A
So
if
you
have
a
lot
of
them,
it
there's
a
huge
benefit
to
being
able
to
see
them
under
an
umbrella
and
manage
them
as
opposed
to
not
knowing
what's
out
there
and
then
this
year
we
took
a
snapshot
at
the
kind
of
top
GDP
our
principles
and
look
for
language
there.
We
made
a
bonus
points,
because
this
was
our
first
time
looking
at
it
and
that
not
a
lot
of
weight
to
it.
But
we
wanted
to
see
what
everyone
was
doing.
A
A
If
you've
had
data
breaches,
and
this
year
we
scaled
the
penalty
to
the
size
of
the
breach
so
pretty
wide,
ranging
from
the
thousand
is
our
our
minimum
bar,
but
up
to
the
hundreds
of
millions
of
records
that
were
lost
in
breaches
and
then
settlements,
and
we
added
global
settlements
this
year,
not
just
US
settlements.
So
that
gives
you
a
sense
of
that.
Kenny
was
the
one
who
assessed
almost
thirteen
hundred
privacy
statements
so
I'll.
Let
him
talk
about
kind
of
what
he
found
here
in
a
minute.
A
I'm
just
gonna
cover
the
top
scorers
real,
quick
here
and
then
we'll
peel
into
that
a
bit.
And
what
can
he
tell
us
what
he
found
so
the
overall
score
out
of
a
hundred
actually
dipped
a
bit
from
prior
years
in
the
it
was
a
little
higher
in
the
70s.
Now
it's
right
at
70,
the
statement
score
was
27
on
average
and
that's
out
of
55
cecily
half
of
the
available
points,
and
that
is
an
area
probably
had
to
pick
one
thing
in
the
whole
lot
of
this
year.
That
was
disappointing.
That's
it.
A
The
previs
privacy
statements
did
not
improve
and
in
fact,
probably
slid
back
a
bit
in
the
scoring
the
tracking
scores
average
40
to
that
of
45.
That's
pretty
strong.
The
news
and
media
segment
is
the
one
that
uses
the
most
trackers,
so
they
were
the
lowest,
but
nobody
was
out
of
bounds
there
and
then
the
usage
of
this
tag,
management
system
or
privacy
solution
was
actually
pretty
high
in
those
sectors.
A
Some
use
it
more
than
others
and
that's
bonus
points
as
well,
so
one
other
quick
thing
on
tracking
and
then
we'll
go
into
the
privacy
statement.
So
this
we
is
data
from
disconnect.
They
have
about
public
site
where
about
600
different
trackers
are
deemed
bad,
that
they'll
automatically
block
if
they
see
them
with
their
extensions
for
the
browsers
or
they're,
actually
now
integrated
into
versions
of
Firefox.
A
This
is
a
this
graphic
is
a
picture
of
the
sites
that
there
are
the
trackers
that
they're
blocking
automatically
on
CNN,
and
so
this
gives
you
a
sense
of
at
least
what
they
feel
are
the
sites
that
are
sharing
data
improperly
and
that
you
shouldn't
be
sharing
data
with
other
sites.
You
might
see,
may
only
have
two
little
bubbles,
and
neither-
and
none
of
them
have
the
red
Red
Cross
through
it.
So
it
varies
significantly
a
site
by
site,
and
so
the
the
most
prevalent
use
of
these
trackers
was
in
the
news
media
segment.
A
C
Yeah
no
problem
nice
Jeff
mentioned
I,
read
around
1200
and
changed
privacy
statements.
We
think
these
are
important
because
it's
the
first
touch
point
with
consumers.
We're
obviously
aware,
as
most
of
you
are,
that
most
people
don't
read
these.
However,
it
is
important
for
companies
to
be
transparent
with
their
consumers.
C
We
have
about
29
variables
that
we
score
the
price
statements
on,
as
you
can
see
from
this
graph,
the
date
stamped
at
the
top.
We
think
that's
important,
mostly
because
companies
need
to
be
updating
their
privacy
policies.
I
mean
GPR
when
to
effect
in
May
of
2018,
and
while
most
of
our
companies
are
us,
it
is
important
to
keep
up
to
date
with
laws
around
the
world,
especially
for
the
larger
companies.
As
you
can
see,
your
overall
around
half
of
the
companies
had
a
date
stamp
at
top.
C
It's
a
super
simple
thing
to
do:
there's
almost
no
reason
for
a
company
not
to
do
it.
That's
why
we
score
it
so
high.
The
archive,
we
think,
is
important
because
consumers
should
be
able
to
tell
or
should
be
able
to
know.
Rather
when
things
change
and
the
archive
is
very
low.
I
mean
three
percent
overall,
the
best
was
the
feds,
but
even
that's
very
low.
C
We
think
that's
important
purely
for
record-keeping.
If
consumers
want
to
know
they
should
be
able
to
know
what
changed
and
that's
really
it.
It's
also
not
a
hard
thing
to
do.
I
mean
if
you
update
your
privacy
policy,
you
have
a
previous
version
somewhere,
so
just
post
it,
the
dmt,
so
dnt
stands
for
do
not
track.
Do
not
track
is
a
standard
developed
mostly
in
the
u.s.
that
is
frankly
passe
at
this
point,
but
it's
required
by
California
law
to
say
whether
or
not
you
both
acknowledged
do
not
track
and
honor
it.
We've
scored
both.
C
A
Just
an
extra
point
on
dnt
that
Apple
actually
dropped
it
out
of
so
far.
It's
a
setting
in
the
browser
for
the
user
to
say
do
not
track
me
and
the
website
is
supposed
to
then
theoretically
honor
it.
You
can
see
that
no
one
ever
really
has
the
w3c
where
the
standard
came
from.
It's
gonna
stop
the
project,
and
so
we
expect
with
the
new
California
law,
not
requiring
DMT.
That's
the
reason
we
had
it
in
really
and
the
expectation
it
might
grow.
A
C
Layer
notice
is
a
very
important
variable
for
us.
Basically,
that
is
essentially
do
you
have
a
table
of
contents
and/or
some
way
for
the
user
to
see
the
way
the
privacy
statement
is
going
to
be
structured
for
most
of
these
sites.
The
privacy
statement
is
very
long,
so
we
advocate
having
at
the
top
either
a
table
of
contents
with
links
and/or
a
summary
that
would
both
get
you
a
score
for
the
layered
notice.
The
reason
for
that
is
basically
most
people
aren't
going
to
read
ten
pages
of
a
privacy
statement.
C
C
We
think
icons
are
important
for
two
reasons:
one
for
readability,
because
it
helps
users
who
don't,
who
may
not
necessarily
have
the
reading
skills
required.
The
icons
help
and
we
see
there
are
companies
that
use
icons.
They'll
use
a
megaphone
for
sharing
they'll
use
each
other
another
good
example.
Yeah.
That's
a
good
example:
those
are
useful
purely
to
help
users
who
are
not
on
the
test,
and
that
is
there
are
companies
that
do
it
most
of
them,
don't,
as
you
can
see
from
the
graph.
C
However,
it's
a
super
easy
thing
to
include
multilingual
is
a
tricky
one.
We
scored
every
website
if
they
had
a
link
to
privacy
statements
that
were
not
in
English.
However,
we
do
have
to
acknowledge
that
websites
can
sort
of
filter
that
using
IP
addresses
so
hypothetically
when
I
was
looking
at
the
privacy
statement
from
the
US
websites
could
include
non
English
knowing
that
I'm
coming
from
the
US.
So
that's
a
sort
of
a
fuzzy
one,
but
we
also
think
that
multilingual
is
important,
especially
given
the
growth
of
Spanish
speakers
in
the
United
States.
C
My
favorite
part,
so
we
have
several
variables
that
deal
with
data
handling,
as
you
can
see
that
so
the
data
not
shared
means
that
there
is
a
statement
in
the
privacy
statement
that
says
we
do
not
share
with
third
parties.
For
my
graph,
you
see
it's
all
over
the
map,
I'm
around
70%
of
the
total
sample
say
they
don't
share.
C
Affiliates
sharing
is
a
little
more
subtle
and
we
actually
added
it
this
year,
because
we
noticed
that,
while
70%
of
the
companies
say
they
don't
share
with
third
parties,
they
do
say
around
20%
give
or
take
say
they
do
share
with
affiliates
within
their
organization,
and
we
think,
from
a
consumer
expectation,
point
of
view
that
language
is
a
little
confusing
right.
They
say
we
don't
share
with
third
parties.
C
However,
we
do
share
with
other
parties
within
our
organization
and
at
a
large
company
that
could
be
a
company
that
has
nothing
to
do
with
their
original
business,
and
so
we
added
a
we
did
not
score
it
very
highly.
So
it's
it's
very
low
weighted.
However,
we
thought
was
important
to
point
out
that
a
good
chunk
of
these
companies
say
we
do
share
data
internally
and,
if
you're,
a
large
organization
that
is
yeah
that
could
be
to
many
many
different
pieces
of
your
company
data
retention
has
a
very
specific
threshold.
C
They
had
to
have
a
date
stamp
on
that.
That's
why
those
numbers
are
so
low,
they
had
to
say
we
retain
the
data
for
X
days
or
X
months
or
whatever
the
vast
majority
of
companies.
Don't
say
that
the
usual
statement
is,
you
know
we
will
retain
the
data
for
certain
business
practices
period
under
gdpr
and
we
think
having
an
actual
time
frame
is
better
but
again
and,
as
you
pointed
out
earlier,
most
of
the
companies
we
study
here
are
based
in
the
US
and
there
is
no
requirement
for
that
here.
C
So
it's
not
strange
that
they
don't
have
that
and
then
bender
compliance,
which
we
also
think
is
a
very
important.
We
actually
wait
this
one
fairly
highly
vendor
compliance
means
that
if
you
are
sharing
data
with
a
vendor,
so
say
a
credit
card
processor
or
a
another
company
that
is
simply
helping.
You
do
your
business,
you
hold
them
to
the
same
privacy
standards
that
you
hold
yourself
and
we,
it
was
good
to
see
the
vendor.
Compliance
overall
was
around
60%.
Again,
their
news
was
highest,
which
is
good,
I
mean,
basically
all
this.
C
The
point
of
this
variable
is
basically
saying
you're
going
to
share
data
with
other
companies
in
any
business
situation.
If
you
require
them
to
be
held
to
the
same
standard,
that's
great!
If
you
don't
say
that,
then
we
are
concerned
that
a
third
party
could
do
something
with
the
data
they're
not
supposed
to
be
doing.
A
Yeah
so
overall
I
mean
we're
looking
for
very
clear
statements
about
what
data
you
collecting.
What
are
you
doing
with
it?
Who
are
you
sharing
it
with,
and
so
these
are
kind
of
specific
aspects
of
trying
to
get
at
that.
Those
answers,
I
think
vendor
compliance,
grew
I'm,
gonna,
say
15
or
20
percent
from
year
to
year.
So
it
was
in
the
40
range
or
something
last
year,
and
now
it's
almost
60
so
that
that
was
a
good
improvement.
Data
retention
is
key.
A
Kenny
mentioned,
used
to
be
I,
think
we
had
it
in
the
40
50
percent
range,
but
because
we
kind
of
ratcheted
down
on
the
definition
of
that
to
not
be
big,
we
saw
a
big
drop,
but
we
expect
that
that's
going
to
be
reflected
in
some
of
the
new
privacy
laws
coming
out,
and
so
it
was
kind
of
an
anticipation
of
that.
So
the
other
thing
we
looked
at
was
six
key
GPR
principles
and
kind
of
summarize
the
data
here
so
Kenny.
You
want
to
walk
us
through
that
sure.
C
Yeah,
so
easy
to
read
is
a
duty
power
requirement.
It's
basically
set
to.
You
should
be
able
to
read
a
privacy
statement
and
if
you
have
a
sort
of
roughly
sixth
grade
dish
level
of
education-
and
we
said
30%
had
that
that's
a
little
bit
of
a
deathblow
part
of
the
problem
with
privacy
statements
is
that
they're
written
by
lawyers
right
these
are
legal
documents,
and
so
it's
not
surprising
that
it's
that
low.
C
So
the
second
one
articulate
data
collected
in
reason,
which
95%
is
very
high,
that
all
that
says
is
we're.
Collecting
this
data
and
we're
gonna
tell
you
why
we
are
doing
it.
It's
either
to
serve
advertising
or
whatever.
There
are
live
reasons.
Businesses.
Do
it.
That's
great
that
a
lot
of
companies
say
yes,
we're
collecting
this
and
we're
gonna.
Tell
you
why
the
next
is
specify
third
parties,
so
this
under
GDP
are
you
have
to
you're
supposed
to
specify
the
categories
of
data
that
you're
sharing
or
the
sorry
the
categories
of
companies
you're
sharing
with?
C
So
you
don't
have
to
actually
lists
the
literal
companies,
but
you
have
to
say:
okay,
we're
gonna
share
with
marketers
we're
gonna
share
with
survey
companies,
we're
gonna
share
with
whatever
that
was
very
low,
and
that
was
I
would
say.
Disappointing
I
mean
that's
a
pretty
easy
criteria
to
fill
the
next
the
DPO,
so
the
data
protection
officer
is
also
required
by
GPR.
This
is
very
high
and
that's
great.
The
requirement
here
was
any
contact
information,
so
we
would
give
a
company.
C
Yes
if
in
an
e-mail
or
a
phone
number
or
an
address
or
whatever,
to
contact
them
about
your
data,
that's
high,
it
should
be
higher.
I
think
is
pretty
simple
requirement
to
fulfill,
especially
given
that
CCPA
is
going
to
go
into
effect
on
January
1st.
It
also
requires
this,
so
we
hope
to
see
that
go
up.
C
Handling
sense
of
data
is
sort
of
a
weird
one,
so
in
GDP
are
there
is,
are
denying
lists
a
set
of
data
that
they
that
the
GDP
are
consider
sensitive.
It's
race,
religion,
there's
about
10,
others
under
Arizona,
and
they
have
to
tell
you
if
they
collect
that
data
and
what
they
do
with
it.
We
scored
mostly
again,
mostly
US
companies.
Very
few
said
this:
that's
not
a
surprise,
given
that
GDP
are
a
doesn't
apply
to
the
US
and
B
article
9
is
very
specific
about
the
kinds
of
data.
C
So
in
a
weird
way,
if
you're
a
company
that
doesn't
collect
sensitive
data
under
GDP
or
you
don't
have
to
say
anything,
you
can
just
ignore
it.
So
that's
that's
why
that
is
so
low
and
then
the
final
one
under
GDP
are
you?
Users
have
to
be
able
to
a
contact.
The
company
through
the
DPO
like
we
say
before
and
be
they
have
to
be
able
to
update
and/or,
delete
their
data.
We've
had
about
half
percent
about
fifty
percent.
Rather
did
this
again
under
US
law.
There
is
no
required
from
that.
C
However,
under
the
CCPA
in
California
and
a
few
other
state
level
laws,
this
user
data
request
is
going
to
be
under
in
certain
states
active
in
the
US.
So
the
fact
that
only
half
did
this
isn't
really
a
surprise
because
they
don't
have
to
at
the
moment,
but
their
companies
are
going
to
have
to
going
forward.
A
B
Actually,
I
think
that,
looking
at
our
industry,
we
do
need
to
see
more
of
a
focus
on
privacy,
I
think
that
with
regulation
like
the
California
consumer,
Privacy
Act,
the
CCPA
as
Ken
you
mentioned,
you
know
to
an
effect.
You
know,
US
versions
of
GDP
are
coming
down
the
pipe.
It
is
kind
of
surprising
to
see
some
of
the
squirts
are
actually
dropped
from
2017
to
2018,
assuming
that
those
are
statistically
significant.
Basically
I
do
think
we
need
to
have
easier
to
read.
Privacy
policy
is
at
the
same
time.
B
Many
consumers
are
not
experts,
they
might
read
these
things
fully
and
so
I
think
we've
got
to
come
back
to
that
point
around
making
sure
that
we're
satisfying
consumer
expectations
and
not
surprising
them,
even
if
the
policy
is
easy
to
read,
I,
think
that
over
time,
consumers
are
going
to
demand
more
privacy,
and
you
know
to
that
end
where
we're
experimenting
that
area
in
Merton
labs.
We
just
released
a
non
privacy
manager
app
recently
and
I,
look
forward
to
seeing
our
industry
continuing
to
focus
more
on
on
privacy
to
work
towards
satisfying
two
more
expectations.
B
A
So
wrapping
up
real,
quick
I
know
we're
about
on
the
hour
just
what
one
of
the
resources
for
those
of
you
have
already
read.
The
report
you've
already
seen
this,
but
there's
kind
of
a
landing
page
that
has
all
the
pieces
at
elion
slash
2018
on
a
roll.
It
has
the
full
report
and
infographic
summarizing
things,
a
little
video
recapping
the
findings,
and
then
we
tried
to
come
up
with
kind
of
a
one-page
checklist.
If
you're
trying
to
do
this.
For
yourself
and
say,
am
I
doing
the
right
things?
A
Here's
the
one-page
checklist
and
you
can
walk
through
these
and
make
you
use
some
of
the
free
tools
that
we
reference
in
the
report
or
your
privacy
statements.
You
would
be
able
to
assess
it
yourself.
Am
I
doing
these
things
and
we
put
whether
it's
a
bonus
or
baseline
there
on
the
right,
that's
less
pertinent
unless
you
care
about
a
score
versus
just
doing
the
right
things
here.
So
that's
your
kind
of
cheat
sheet
and
then
finally,
next
steps
use
that
checklist
and
evaluate
your
status.
A
We
are
gonna
kind
of
mine,
this
data
further
going
forward
through
the
rest
of
the
year
and
do
kind
of
mini
reports
you
might
think
or
webinars
or
whatever,
on
deeper
on
privacy,
deeper
on
email,
authentication
deeper.
On
some
of
the
findings,
we
got
insight
security,
so
stay
tuned
for
that
we're
already
starting
our
methodology
review
for
the
next
audit.
A
Our
intent
going
forward
is
to
releases
at
the
end
of
January
every
year,
so
that
means
we
have
to
have
the
methodology
out
in
roughly
September,
which
means
we
start
talking
about
it
in
May,
and
so
we
look
at
everything
we
look
at.
What
sectors
do
we
have
the
right
sectors?
Are
we
building
those
sectors
properly?
What
tools
can
we
use
to
get
data?
What
criteria
should
we
use
and
how
should
they
be
weighted?
A
So
we
reevaluate
kind
of
everything
every
year
to
make
sure
that
we're
reflecting
the
right
things
so
any
input
anyone
wants
to
give
us.
We
very
much
appreciate
and
I'm,
not
sure
we
have
time
for
questions
I
mean
we
can,
it
would
go
over.
I
know
we're
gonna
lose
some
people,
but
if
anyone
has
any
questions,
now's
the
time
to
ask.