We often get asked about data security (how to keep things safe) and local regulations and certifications regarding same. Our general thoughts on this are as follows
- Government regulations tend to end up becoming part of the risk/cost/benefit equations in a business, which is not particularly comforting for customers.
- Example: some years ago an Australian bank had a mail server mis-configured to allow relaying (i.e., people could send phishing emails pretending to legitimately originate from that bank). A caring tech citizen reported the issue to the bank. Somehow, it ended up with the legal department rather than a system/network administrator. The legal eagles decided that the risk to the organisation was fairly low, and didn’t forward it for action at that time. Mind that the network admin would’ve been able to fix up the configuration within minutes.
- Appreciate that certifications tend to mainly give you a label to wave in front of a business partner requiring it, they do not make your business more secure.
- Data leaves footprints. For instance, some people use a separate email address for each website they interact with. Thus, when a list of email addresses leaks, saying “it didn’t come from us” won’t hold. That’s only a simple example, but it illustrates the point. Blatant denial was never a good policy, but these days it’ll backfire even faster.
- Recent legislation around mandatory data retention only makes things worse, as
- companies tend to already store much more detail about their clients and web visitors than is warranted, and
- storing more activity data for longer just increases the already enlarged footprint.
So what do we recommend?
- Working within the current legal requirements, we still advise to keeping as little data as possible.
- More data does not intrinsically mean more value – while it’s cheap and easy to gather and store more data, if you’re actually actually more strategic about what you collect and store, you’ll find there’s much more value in that.
- Fundamentally, data that you don’t have can’t be leaked/stolen/accessed through you. That’s obvious, but still worth noting.
- Our most critical example of this is credit card details. You do not want to store credit card details, ever. Not for any perceived reason. There are sensible alternatives using tokens provided by your credit card gateway, so that clients’ credit cards never touch your system. We wrote about this (again) in our post “Your Ecommerce Site and Credit Cards” last year.
Why? It’s fairly easy to work out from a site’s frontend behaviour whether it stores credit cards locally, and if it does, you’re much more of a target. Credit card details provide instant anonymous access to financial resources. Respect your clients.
- Our most critical example of this is credit card details. You do not want to store credit card details, ever. Not for any perceived reason. There are sensible alternatives using tokens provided by your credit card gateway, so that clients’ credit cards never touch your system. We wrote about this (again) in our post “Your Ecommerce Site and Credit Cards” last year.
- More secure online architecture.
- We’ll do a separate post on this.
- If you have a data breach, be sensible and honest about it.
- If your organisation operates in Australia and “with an annual turnover of $3 million or more, credit reporting bodies, health service providers, and TFN recipients, among others.“, the Notifiable Data Breaches (part of the Australian Privacy Act) scheme applies, which came in to force this February 2018, applies to you.
We’re happy to advise and assist. Ideally, before trouble occurs. For any online system, that’s a matter of when, not if.
(And, of course, we’re not lawyers. We’re techies. You may need both, but never confuse the two!)