Rants
Questions
Soapbox
Best Practices
Apply today for a FREE subscription to CIO Magazine!
Wed, Sep 23, 2009 10:42 EDT

|
Posted by: Ariel Silverstone in Best Practices Topic: SecurityBlog: Bare Knuckles Security
Current Rating: |
Create A Privacy Policy - Our Story So Far
Let's take a look at what we accomplished so far, in the previous article:
Sample Privacy Policy Purpose: To define privacy expectations of visitors to the ArielSilverstone.com website.
What We Collect We respect the privacy of our visitors. We generally do not collect personally-identifying information on this website. We do, however:
a) Employ certain automated tools that collect statistical information visitors to our site.
b) Provide you with the option to leave comments, or contact us, by entering your email address and, optionally, other contact information as you may choose to share with us.
Today, we will continue by focusing on the How and discuss cookies.
How do we collect personally identifying information?
When creating a privacy policy, we must consider all elements of our web site. These include both automated means and human activated techniques. For example, without even intending to, you probably are collecting IP addresses, browser versions, and the location (web site) the visitor came from, and other miscellanea. In addition, certain tools, for example Overture, collect other information, some of which is not even shown to you without a direct request.
In the non-automated department, each web site has its own reason d'etre. Do you have a contact form? Survey? Do take credit cards? Do you ask for email address?
So now, let's compile a list of all we ask for and all that we automatically get. Let's review that list for PII and add the items to our policy.
The Cookie Jar
Many web sites, and many programs running on web sites, collect certain information and deposit such information in Cookies. Cookies are small files that reside on the computer visiting such sites. There are generally two types of cookies: Session based and permanent.
As the name suggest, a session cookie exists for the duration of the visit to that specific site or program. The permanent variety is typically stays on the visiting computer until deleted by the user or by another program. Cookies can be either human-readable or machine-readable, and could be encrypted. The "dirty" secret of cookies is that sometimes cookies can be shared between multiple sites. That means that if you put information into one site, that information can be carried by a cookie and give to another site, even to a site that you have not given permission to - to have this information!
Be careful when using cookies. There are many tools out there to tell a visitor if you are embedding cookies in their machines, and the savvy visitors will be suspicious of permanent cookies and cookies which are able to be read by multiple sites. I know I would.
If you use cookies, make sure that you inform your visitors:
Sample Privacy Policy Purpose: To define privacy expectations of visitors to the ArielSilverstone.com website.
What We Collect and How We respect the privacy of our visitors. We generally do not collect personally-identifying information on this website. We do, however:
a) Employ certain automated tools that collect statistical information visitors to our site.
b) Provide you with the option to leave comments, or contact us, by entering your email address and, optionally, other contact information as you may choose to share with us.
c) From time to time, we may offer you to opportunity to participate in surveys or polls, and we may be provided with such information as you choose to provide us.Cookies
Privacy policies, how to write one and most important how to understand one, is of utmost importance nowadays. Writing a privacy policy that is clear to the users, make them feel safe, complies with norms and at the same time lets us gather information important to our business is something we should all care about.