Less prominent government domains have worse security
Roughly half of all domains now using mandatory internet standards
Roughly half of all domains now using mandatory internet standards
Government domains with low public profiles lag well behind on the adoption of mandatory modern internet standards, according to the latest survey by the Forum for Standardisation. The new data is the first to cover an extended set of nearly 2,600 domains. The Forum's previous surveys related to a smaller group of 550 domain names.
Of the scanned domain names, 53 per cent comply with all the mandatory web standards (DNSSEC, TLS, HTTPS, HSTS, IPv6). Only 44 per cent were found to support the relevant e-mail standards (DNSSEC, SPF, DKIM, DMARC, STARTTLS/DANE, IPv6). Extension of the survey to include 2000-plus additional names – nearly all central government domains – has resulted in much lower compliance scores than previously established. However, direct comparison of successive reports isn't possible, because the various standards were previously considered individually. By contrast, the latest report focuses on the proportion of domains that score 100 per cent when tested on the Internet.nl portal (excluding tests for standards not covered by Joint Ambition Statements).
Following publication of the disappointing findings, the responsible government ministers, Dilan Yeşilgöz-Zegerius and Alexandra van Huffelen, faced critical questioning in the Dutch parliament.
The above-mentioned standards have been on the Forum for Standardisation's 'use-or-explain' list for some time. Government and quasi-government organisations are therefore more or less obliged to implement the standards. All the standards are also covered by Joint Ambition Statements agreed within the Pan-governmental Digital Government Policy Liaison Forum (OBDO). Given that the newest Ambition Statement, regarding IPv6, expired at the end of 2021, all government domains should now support the standards. In recent years, however, adoption of all the standards has faltered.
For its latest six-monthly survey, the Forum for Standardisation greatly extended its list of domain names of interest. Nearly all the newly added names belong to the central government. Local governments in the Netherlands operate many thousands more domains, but recording them all is very challenging. The Forum for Standardisation is therefore calling for improved management of government domain names.
It often appears to be unclear who is responsible for ensuring support for the internet standards, particularly where domain names linked to joint initiatives are concerned. That is clearly reflected in the web standard adoption statistics.
The low levels of support for mail standards by local government domains is very probably down to many local authorities buying mail services from the big US cloud service providers. Last year's surveys revealed that the same problem had even led to a drop in support for DNSSEC and DANE for mail.
For years now, service providers have been promising to implement the standards, and many government organisations appear to be using those promises to claim temporary exemption, as permitted under the 'use-or-explain' regime. Meanwhile, the Forum for Standardisation has been trying to persuade service providers to enable modern security standards on their mail services.
"Our newly extended survey shows that many Dutch government organisations still have plenty to do," said the Forum's Chair, Larissa Zegveld. "Shortcomings in domain name management and support for internet security standards remain widespread. As a result, both the government bodies themselves and the people and organisations that those bodies exchange information with are at risk. Fortunately, an increasing number of organisations, including SSC-ICT, DICTU and the cities of 's-Hertogenbosch and Heerlen, are setting a good example."
"In a lot of cases, problems are linked to the choice of ICT service provider. So, in future surveys, we plan to put the spotlight on the service providers that are failing to implement the appropriate standards. In the meantime, we're calling on the service providers in question to prioritise implementation in the interests of their public-sector and private-sector customers."