BvD: Muster-AV-Vertrag für das Gesundheitswesen (DS-GVO) und Umgang mit Altverträgen
https://www.bvdnet.de/bvd-arbeitskreise/arbeitskreis-medizin/
[in German] – heise on privacy-compliant inclusion of social media buttons
List of web security and privacy scanner web sites
Privacy specific scanner:
Other scanners:
- https://requestmap.herokuapp.com/
- https://requestmap.webperf.tools/
- https://webpagetest.org/
- https://lookyloo.circl.lu/
- https://themarkup.org/blacklight
- http://sitecheck.sucuri.net/ (emphasis on vulnerabilities)
- https://csi.forcepoint.com/ (emphasis on vulnerabilities, single page)
- http://observatory.mozilla.org/ (emphasis on headers)
- http://securityheaders.io/ (emphasis on headers)
- http://urlscan.io/ (emphasis on interactions while loading URL)
- http://www.htbridge.com/ssl/ (emphasis on SSL)
- https://www.htbridge.com/websec/ (emphasis on headers)
- http://ssllabs.com/ssltest/
- http://www.magereport.com/ (for magento sites only)
- http://www.ssltrust.info/ (checks for entry on malware, spam lists)
- http://hardenize.com/
- http://webcheck.me/
- http://www.unmaskparasites.com/
- http://cryptoreport.websecurity.symantec.com/checker/
- http://www.scanmyserver.com/
- http://safeweb.norton.com/
Online web spiders
[htbridge] Mobile app scanner (free)
HTTP Security Headers Overview
Good blog post with details on the different security headers and how to set them.
- XSS-Protection
- Content Security Policy
- HTTP Strict Transport Security (HSTS)
- HTTP Public Key Pinning (HPKP)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Cookie Options
Open WPM (web privacy measurement scanner)
From the website below:
“Web Privacy Measurement is the observation of websites and serves to detect, characterize and quantify privacy-impacting behaviors. Applications of Web Privacy Measurement include the detection of price discrimination, targeted news articles and new forms of browser fingerprinting. Although originally focused solely on privacy violations, WPM now encompasses measuring security violations on the web as well.”
Germany/Bavaria: DPA scanning for web sites for privacy-compliant Google Analytics use
In 2012, the Bavarian DPA scanned German web sites for the privacy compliant use of Google Analytics.
The DPA checked
- if a written processing agreement had been put in place with Google,
- if the privacy notice on the web site was transparent on the use of Google Analytics and the users’ option to avoid being tracked
- if the Google Analytics’ “anonymization feature” was enabled in the web site’s source code
13.404 Webseiten had been tested 2.371 companies were contacted for shortcomings.
More information (in German) on https://www.lda.bayern.de/de/google_analytics.html
OWASP OWTF web/server scanner
OWASP mobile security project
[GMV Blog] US Regulation of mobile apps – case studies
Quick introduction with some examples
https://www.gmv.com/blog_gmv/regulation-of-mobile-apps-part-1-regulation-in-the-usa/