INDIVIRTUAL - TECHNISCH PARTNER IN DIGITALE DIENSTVERLENING

Quality of SSL protection for Dutch financial institutions

November 23, 2015

Quality of SSL protection for Dutch financial institutions

In follow up of Troy Hunt his post about SSL rating of the Australian banks and Damien Guard about the US financial institutions, here is the list of the Dutch financial institutions.

For this test I used the Qualys SSL Server Test, it can perform a deep analysis of the configuration of a SSL web server on the public Internet. The Dutch financial institutions in the list below are checked against the most important attributes Qualys tests for:

Should not support Should support Vulnerable
Institution  Grade SSL3 SHA1 RC4 TLS 1.2 F/w sec POODLE
ING A+  PASS PASS PASS PASS PASS PASS
Rabobank A+  PASS PASS PASS PASS PASS PASS
Triodos Bank A+  PASS PASS PASS PASS PASS PASS
Binck A+  PASS PASS PASS PASS PASS PASS
van Lanschot A+ PASS PASS PASS PASS PASS PASS
Leaseplan bank A+ PASS PASS PASS PASS PASS PASS
NIBC Direct A+ PASS PASS PASS PASS PASS PASS
Delta Lloyd A PASS PASS PASS PASS PASS PASS
Ohra A PASS PASS PASS PASS PASS PASS
Deutsche bank A  PASS PASS PASS PASS PASS PASS
ASN Bank A  PASS FAIL PASS PASS PASS PASS
ICS Cards A  PASS FAIL PASS PASS PASS PASS
Regiobank A  PASS FAIL PASS PASS PASS PASS
SNS Bank A  PASS FAIL PASS PASS PASS PASS
Theodoor Gilissen A  PASS FAIL PASS PASS PASS PASS
ABN AMRO A-  PASS PASS PASS PASS PASS FAIL
Achmea A-  PASS PASS PASS PASS FAIL PASS
Nationale Nederlanden A-  PASS FAIL PASS PASS FAIL PASS
Aegon1 B  PASS PASS PASS PASS FAIL PASS
Amsterdam Trade Bank1 B  PASS PASS PASS PASS FAIL PASS
Westlandutrecht Bank F  PASS PASS PASS PASS FAIL FAIL
1 This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B

Well as you can see it isn’t that bad here in the Netherlands, only 3 B’s and 1 F grade, compare to the Australian Banks and US financial institutions that’s pretty OK! But of course It can be better in some cases, especially because they are financial institutions.

Let me know if I missed some Dutch financial institutions.

Erwin Griekspoor

Erwin Griekspoor