Demos / Security and compliance
Demo · 1:04
Outside in
Email spoofing, TLS, website headers and certificates checked from the internet, then re-checked after the fixes.
Recorded on the real product against our demo company, Lakefront Works. The people and data are fictional.
Transcript
What can anyone on the internet see about Lakefront? Sasha starts with email. The sender list is fine, but there is no DMARC record and no DKIM signature, so anyone can send mail that looks like it came from the company. The website's encryption gets an A: modern versions only. Its security headers get an F. There is no content security policy, and the setting that forces secure connections is too short. And the certificates are good for another six months. Four checks, plain answers, no tools to install.
After IT publishes a DMARC record and switches on DKIM, the same check runs again. Mail is now signed, and receiving servers are told to quarantine anything that fakes the domain. The website headers go from F to A. The problem and the proof it was fixed sit on the same ticket, ready for the auditor.