Do the Companies Entrusted with Your App Dev and Testing Protect Your Data?
Surprisingly, a new study indicates financial organizations use actual data when building and testing apps.
I came across a rather disturbing bit of information the other day: many financial services organizations use real data in the development and testing of applications. At least that’s the findings of a study commissioned by Compuware Corp. and conducted by the Ponemon Institute, an independent research firm focused on information and privacy management practices. To be more exact, the study found that 83% of financial service companies use real data in the development and testing of applications.
Perhaps these companies overlook that obvious security flaw because they figure application development and testing is typically done in the back room, off the main network, in a non-production environment. Or perhaps, from what I’ve read, developers often prefer to use the real McCoy when developing and testing apps to ensure they are ready for prime time when the time comes. Or perhaps there’s some other reason.
Regardless, it’s not the best practice. And you’d think financial services organizations wouldn’t be doing such a thing. After all, financial companies these days are bound by so many data privacy regulations, such as the Sarbanes-Oxley Act (SOX) of 2002 or the data breach notification laws now in effect in a majority of states. And these regulations do not differentiate between product and testing environments; data is data is data, and if it’s supposed to be safe and protected, well then…
So this (to me, anyway) surprising statistic got me wondering what the developers many companies have contracted to build and test applications are doing. It’s a critical question I think should be added to a security checklist that needs to be picked through during the deal-making and then deal-signing phases of any outsourcing contract.
When you ask whether your outsourcer is ISO 27001- or ISO 27002-certified (two standards that define and specify information management systems for examining risks, threats, and vulnerabilities and implementing controls and management processes), and and exactly who will be touching the code that’s being developed and tested, and whether they’ve had extensive background checks; and when you provide the outsourcer with explicit directions regarding who, and with whom, your code will be shared; you should probably bring up the data point.
Forrester Research suggests four steps that companies should follow regarding data and application development and testing: 1) take inventory of test data requirements by defining the regulations and practices you need to comply with; 2) assess your risks by categorizing the sensitivity of production data and determining what data, if any, can be used; 3) create a strategy for replacing production data by masking or depersonalizing data when necessary; and 4) determine who will enforce the practices.
What about you, wise readers? Do the findings from the Compuware/Ponemon study surprise you? And more importantly, do you have any advice or wisdom when it comes to ensuring outsourcers hired to develop and test applications are safeguarding data?
Previous Post: When Offshoring Doesn’t Add UpNext Post: Satyam Refuses to Become the Forgotten IT Services Provider
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
