2016 Presidential Candidate Security Investigation (infosecinstitute.com)

New submitter Fryan writes: InfoSec Institute has assessed the security posture of 16 of the presidential candidates' websites. This is an indicator of the level of security awareness the candidate and the campaign staff has. The recent breaches and security lapses of high profile individuals highlight the absolute need for everyone to take security awareness seriously. The hacking of the Director of the CIA's (John Brennan) personal email account, and the storage of classified emails on a personal email server with Hillary Clinton, show how damaging a lack of basic good security hygiene can be. In this survey (of only the best known presidential candidates, not the scads of others), the authors give both their highest grade (an A) and lowest (a D) for candidates still in the race to two Republicans, Ben Carson and Jim Gilmore, respectively; surprising for a tech-focused campaign, Lawrence Lessig (who has ended his candidacy since the survey began) ranked even lower, with a D-.

Speaking of presidential candidates, the fourth Republican debate, hosted by Fox Business, will kick off about an hour after this post goes live (9:00 PM Eastern, 0200 GMT). Feel free to discuss it alongside the security report.

Comments

Really?

[TWX]

From TFA:

InfoSec Institute has assessed the security posture of 16 of the presidential candidates' websites. This is an indicator of the level of security awareness the candidate and the campaign staff has.

This assertion is false. First, the candidate has other things to be concerned about. His IT staff, who will probably not follow him to the political office if he's elected given the nature of government bureaucracy, handle it. Second, a web site is a glorified poster and graffiti wall. It's there for John Q Public. Media organizations are provided with itineraries and possibly with the contents of speeches and other material directly, they do not have to go to the candidate's website. Third, any maliciousness done to the candidate only serves to strengthen the candidate, as those who were already in-favor of the candidate will not lessen their opinions based on a website hack, and those who were undecided may sympathize with the candidate after such an attack. Fourth, given the propensity for semianonymous abuse of comments sections, the candidate's staff already have to peruse comments to moderate/censor, so long-term abuse that could paint a candidate as something that they don't want to be is unlikely.

If you want to know how a candidate handles security, follow how they handle money, and how quickly they return contributions that come from undesirable sources, or how they handle public appearances and interaction with specific persons. At this early stage that's probably more of a tell than any website.

Re:Really?

[ftexperts]

Hi, I'm Jonathan Lampe, the author of the original article.

>> If you want to know how a candidate handles security, follow how they handle money

I started my research after I noticed that most of these sites DO handle money, either through merchandise stores or donations. My original report (http://www2.infosecinstitute.com/l/12882/2015-10-19/zbwt6/12882/121089/2016_Presidential_Hacks.pdf) dug into how the top five candidates handle money on their web sites; it looks like most of the links in this thread are reading my SECOND bit of research about who's using WordPress and how badly it's been configured (http://resources.infosecinstitute.com/doesnt-any-presidential-candidate-know-how-to-secure-wordpress/).

infosec institute is bullshit

[hsmith]

Why not evaluate the candidate shitty policies on information security? Like Carly who can't grasp math and is in favor of back doors into software and encryption.

What a stupid "investigation"

Even their page doesn't have SSL by default, when you go to the HTTPS site, it uses outdated encryption even with a modern browser.

http://i.imgur.com/de0eBK8.png

Live-commenting the debate

[PopeRatzo]

Donald Trump just said, "Wages are too high."

Discuss.

Re:We're not the MSM

[Okian Warrior]

"If I become president, we're all going to be saying Merry Christmas again, that I can tell you."

And you translated that to "force Christian law the entire USA".

Please stop posting political pot-shots. You're not very good at it.