Application of Security Technologies in the Public Websites of Banks in Serbia

In this publication, the collected data in the course of a survey are summarized, systemized and analyzed. The survey is conducted in the autumn of 2018 and is focused on the usage of the HTTPS protocol in the public web sites of Serbian banks. The scope of the survey is limited only to the public site of the particular bank and 27 web sites were explored. All of them belong to Serbian banks, which are licensed by the National Bank of Serbia. The HTTPS protocol in the last years is used as the default protocol by many web applications. The study shows that from all 27 Serbian banks licensed by the Serbian National Bank, 81.5% (22 banks) of the surveyed bank's sites are using HTTPS without problems, 11.1% (3 banks) are using HTTPS with some problems and 7,4% (2 banks) are not using HTTPS at all. From banks that are using HTTPS without any problems, the majority - 72.7% (16 banks) use simple Domain Validation (DV), and the rest - 27.2% (6 banks) use Extended Validation (EV) types of certificates. The most popular certification authorities are Thawte with share of 27.2% (6 banks), Go Daddy Secure Certificate Authority and GeoTrust - each with share of 18.1% (4 banks), cPanel Inc. Certification Authority - 13.6% (3 banks), and etc. One bank uses free certificate from Let's Encrypt Authority X3. The validity period varies from 3 months (typically issued from cPanel and Let's Encrypt) to 3 years (typically issued from Go Daddy). Only 7.4% (2 banks) of all Serbian banks are using the latest HTTP/2 protocol.