by Ed Martin|VP, Engineering
One of the things I like about living in Northern California is the easy access to the variety of wineries and related events, mostly concerts and outdoor events. Many of my favorite wineries have web sites where I can purchase tickets to these events. I happily log into the web site, see that the site is secure, and merrily enter my personal info and credit card to get my tickets.
After my experience with one winery web site (and I’m not going to mention which one), I’m questioning whether or not I should trust them or others with my personal data. On that website, I noticed that on the page where I entered in my data (including my credit card), it wasn’t using SSL, i.e. no little padlock meaning an insecure transmission. I thought, this was clearly a mistake. I wasn’t about to enter any data this way, so I called the winery directly.
The agent on the phone, though courteous, was completely oblivious to my security concerns. He first informed me that although the forms page was not using SSL, the page it posted to did (The obvious question was how do I, as a visitor to the site, know that the form post is secure??) Ok, the winery clearly hired a sub-par web consultant to build their pages. I can live with that. However, what was even more frightening was I later found out my personal data was collected on a spreadsheet and emailed to one of their vendors as an attachment!
Unfortunately, this isn’t an isolated incident. I’ve seen similar behavior in some past clients I’ve worked with, where we’ve received “sample” or “test” data that contained real customer personal information. Even worse, we’ve received the files over email, unencrypted. I’ve since informed those clients of the risks, and they’ve since done a better job with their data protection.
The problem is clearly one of education. Data security is something that many companies don’t seem to take enough action to enforce. All you have to do is read the news weekly to find there’s some personal data breach by yet another company. As I’ve demonstrated above, it’s not enough any more to just have a secure web site. What’s done with the data after it’s collected will matter to the consumer as well.
At Loyalty Lab we’ve taken the extra step of becoming Visa CISP (Cardholder Information Security Program) certified. The Visa CISP, if you’ve not heard of it before, is a set of best security practices that any company handling credit card data should follow. It follows the PCI (Payment Card Industry) best practices, and consists of 12 major requirements, broken down into the following categories:
- Build and Maintain a Secure Network
- Protect Cardholder Data
- Maintain a Vulnerability Management Program
- Implement Strong Access Control Measures
- Regularly Monitor and Test Networks
- Maintain an Information Security Policy
In order to receive the certification, you must pass a security audit every year to ensure your company is meeting the PCI security requirements.
Having worked the last 10 years in a variety of marketing systems, I’ve dealt with a myriad of security controls to ensure the protection of private consumer data. The Visa CISP program is the best I’ve encountered. As a consumer, you should be looking for sites that are Visa CISP certified to know your data is safe. As a merchant, any personal consumer data should only be exchanged with a partner who is Visa CISP certified.