Best Practices Report

Scan Name:	WebScantest
Date:	12/13/2011 4:15:27 PM
Authenticated User:	(none)
Total Links / Attackable Links:	266 / 218
Target URL:	http://www.webscantest.com/
Reports:

Security Status - Complete

Vulnerability

Best Practice

Exposure

Vulnerability Trend

Summary

This information has been gathered during a scan of your web application. By checking your online properties for issues such as missing privacy statements, insecure data collection forms, cookie presence and third-party links, the scan generates an automatic checklist of potential best practice issues. By taking advantage of this information, you can then proactively filter and prioritize identified issues to ensure faster remediation of your organization's most critical privacy concerns.

Best Practice Details

Issue

Answer

General

All pages link to one of the site's approved privacy policy pages: (Details )

FALSE

All pages include P3P headers:	FALSE
Click here for more information.
#ClickHereMessage#

Site has avoided "web beacons":

TRUE

Web Beacons can allow third-parties to monitor the activity of customers at a site. This may be a source of concern to your Privacy policy.

Site uses the POST method for all form submissions: (Details )

FALSE

Forms that submit over the GET protocol can often present privacy problems to users of public terminals because their form submission values would be visible in the browser's history.

When submitting sensitive data, process prevents browser form cache:	FALSE
Form POSTs involving sensitive data should result in a 302 to prevent browsers from caching credentials in browser "Form Cache".
#ClickHereMessage#

Site includes shopping cart (e-commerce) functionality:	FALSE
Using a secure protocol for Login is critical to avoid easy theft of user credentials.
#ClickHereMessage#

User Accounts / Sessions

FALSE

Using a secure protocol for Login is critical to avoid easy theft of user credentials.

TRUE

Form POSTs should result in a 302 to prevent browsers from caching credentials in browser "Form Cache".

TRUE

When logging in the user should be given a new Session ID to prevent escalating privileges for an attacker.

Session cookie deleted when browser is closed:	FALSE
Allowing users to stay logged after closing the browser may present privacy and security concerns at public terminals.
#ClickHereMessage#

Site includes a user registration form:	FALSE

#ClickHereMessage#

Site includes a "Change Password" form:	FALSE

#ClickHereMessage#

Site includes a license agreement form:	FALSE

#ClickHereMessage#

Personal Data

Site collects credit card information:	FALSE
Sites that collect this type of information have a greater responsibility and liability to protect their users from identity theft.
#ClickHereMessage#

Site collects Social Security Numbers:	FALSE
Sites that collect this type of information have a greater responsibility and liability to protect their users from identity theft.
#ClickHereMessage#

Site collects email addresses:	TRUE

#ClickHereMessage#

Site collects customer names:	TRUE

#ClickHereMessage#

Site collects customer mailing addresses:	TRUE

#ClickHereMessage#

Site collects customer phone numbers:	FALSE

#ClickHereMessage#

Site collects customer birth dates:	FALSE

#ClickHereMessage#

Privacy Pages Found

URL	In approved list?
http://www.google.com:80/privacy/	FALSE
http://www.webscantest.com:80/privacy.php	FALSE