Cyber Security Standards in Popular Russian Websites through HTTP Observatory measurements

Abstract

Online user security is strongly reliant on a number of factors. One of the most important steps in enhancing data and communication security on well-known websites and a variety of internet services is adhering to security standards and using reliable and cutting-edge technology. These standards and technologies were developed and tested recently. Our investigation at the CERTFA Lab on 50 well-known websites shows that their security is comparable to that of the rest of the world, and very few websites are completely utilizing new security standards and technology. In fact, Russia has strong and comprehensive cyber capabilities. Websites run by the Russian government are subject to unprecedented cyberattacks, and technical measures have been taken to block international online traffic. Although domestic websites have operated successfully within the nation, some security measures need to be taken more seriously. According to our investigation, 47 of the websites we looked into have been configured with CSP2, with Yandex.ru, Ozon.ru, and wileberries.ru's implementations having more specifics and being more secure than those of the other websites, which used the upgrade-insecure-requests option as the default setting for CSP. Additionally, the results of the analysis of contemporary standards used in this study (DNSSEC, CAA, DMARC, SPF, and Expect-CT), which are mandated for the majority of Internet businesses, show that well-known Russian websites have correctly implemented these standard configurations.