Taking A Critical Look at The Security Policies of An Ecommerce Website

By Mike OJ

Thursday, July 16, 2020

6mins Read 

It a common knowledge amongst eCommerce business owners, that eCommerce websites are a major target for hackers, fraudsters, and yes, even for your competitors. Just think about the thousands of user IDs, personal information, product catalog and prices, financial information including credit card details a typical eCommerce site stores. That is what makes eCommerce sites, big and small, so attractive to cybercriminals to exploit and competitors to leverage on.

Security threats are constantly evolving, and compliance requirements are becoming increasingly complex. Organizations large and small must create a comprehensive security program to cover both challenges. Without a security policy, it is impossible to coordinate and enforce a security program across an organization, nor is it possible to communicate security measures to third parties and external auditors.

A few key characteristics make a security policy efficient: it should cover security from end-to-end across the organization, be enforceable and practical, have space for revisions and updates, and be focused on the business goals of your organization.

In this blog post, we will be having a thorough discussion on the following What an information security policy is and the best practices to keep in mind when writing an information security policy.

What is an Information Security Policy?

An information security policy (ISP) is a set of rules that guide individuals who work with IT assets. Your company can create an information security policy to ensure your employees and other users follow security protocols and procedures. An updated and current security policy ensures that sensitive information can only be accessed by authorized users.

The Importance of an Information Security Policy

Creating an effective security policy and taking steps to ensure compliance is a critical step to prevent and mitigate security breaches. To make your security policy truly effective, update it in response to changes in your company, new threats, conclusions drawn from previous breaches, and other changes to your security posture.

Make your information security policy practical and enforceable. It should have an exception system in place to accommodate requirements and urgencies that arise from different parts of the organization.

Key Elements of an Information Security Policy

A security policy can be as broad as you want it to be from everything related to IT security and the security of related physical assets, but enforceable in its full scope. The following list offers some important considerations.

1. Purpose
First state the purpose of the policy which may be to:

• Create an overall approach to information security.
• Detect and preempt information security breaches such as misuse of networks, data, applications, and computer systems.
• Maintain the reputation of the organization and uphold ethical and legal responsibilities.
• Respect customer rights, including how to react to inquiries and complaints about non-compliance.

2. Audience
Define the audience to whom the information security policy applies. You may also specify which audiences are exempted from the policy (for example, staff in another business unit that manages security separately may not be in the policy's scope).

3. Information security objectives
Guide your management team to agree on well-defined objectives for strategy and security. Information security focuses on three main objectives:

• Confidentiality—only individuals with authorization should access data and information assets
• Integrity—data should be intact, accurate and complete, and IT systems must be kept operational
• Availability—users should be able to access information or systems when needed

 Need a Better Host?

4. Authority and access control policy

• Hierarchical pattern—a senior manager may have the authority to decide what data can be shared and with whom. The security policy may have different terms for a senior manager vs. a junior employee. The policy should outline the level of authority over data and IT systems for each organizational role.
• Network security policy—users can only access company networks and servers via unique logins that demand authentication, including passwords, biometrics, ID cards, or tokens. You should monitor all systems and record all login attempts.

5. Data classification
The policy should classify data into different categories, which may include “top secret”, “secret”, “confidential” and “public”. Your aim for classifying data is:

• To ensure that sensitive data cannot be accessed by individuals with lower clearance levels.
• To protect highly important data and avoid needless security measures for unimportant data.

6. Data support and operations

• Data protection regulations—systems that store personal data, or other sensitive data, must be protected according to organizational standards, best practices, industry compliance standards, and relevant regulations. Most security standards require, at a minimum, encryption, a firewall, and anti-malware protection.
• Data backup—encrypt data backup according to industry best practices. Securely store backup media, or move back up to secure cloud storage.
• Movement of data—only transfer data via secure protocols. Encrypt any information copied to portable devices or transmitted across a public network.

7. Security awareness and behavior
Share IT security policies with your staff. Conduct training sessions to inform employees of your security procedures and mechanisms, including data protection measures, access protection measures, and sensitive data classification.

• Social engineering—place a special emphasis on the dangers of social engineering attacks (such as phishing emails). Make employees responsible for noticing, preventing, and reporting such attacks.
• Clean desk policy—secure laptops with a cable lock. Shred documents that are no longer needed. Keep printer areas clean so documents do not fall into the wrong hands.
• Acceptable Internet usage policy—define how the Internet should be restricted. Do you allow YouTube, social media websites, etc.? Block unwanted websites using a proxy.

8. Responsibilities, rights, and duties of personnel
Appoint staff to carry out user access reviews, education, change management, incident management, implementation, and periodic updates of the security policy. Responsibilities should be clearly stated out as part of the security policy.

The Best Practices for Drafting Information Security Policies

1. Information and data classification—can make or break your security program. Poor information and data classification may leave your systems open to attacks. Also, a lack of inefficient management of resources might incur overhead expenses. A clear classification policy helps organizations take control of the distribution of their security assets.
2. IT operations and administration—should work together to meet compliance and security requirements. Lack of cooperation between departments may lead to configuration errors. Teams that work together can coordinate risk assessment and identification through all departments to reduce risks.
3. Security incident response plan—helps initiate appropriate remediation actions during security incidents. A security incident strategy provides a guideline that includes initial threat response, priority identification, and appropriate fixes.
4. SaaS and cloud policy—provides the organization with clear cloud and SaaS adoption guidelines, which can provide the foundation for a unified cloud ecosystem. This policy can help mitigate ineffective complications and poor use of cloud resources.
5. Acceptable use policies (AUPs)—helps prevent data breaches that occur through the misuse of company resources. Transparent AUPs help keep all personnel in line with the proper use of company technology resources.
6. Identity and access management (IAM) regulations—let IT administrators authorize systems and applications to the right individuals and let employees know how to use and create secured passwords. A simple password policy can reduce identity and access risks.
7. Data security policy—outlines the technical operations of the organization and acceptable use standards under the Payment Card Industry Data Security Standard (PCI DSS) compliance.
8. Privacy regulations—government-enforced regulations such as the General Data Protection Regulation (GDPR) protect the privacy of end-users. Organizations that don’t protect the privacy of their users risk losing their authority and may be fined.
9. Personal and mobile devices—nowadays most organizations have moved to the cloud. Companies that encourage employees to access company software assets from any location, risk introducing vulnerabilities through personal devices such as laptops and smartphones. Drafting a policy for the proper security of personal devices can help prevent exposure to threats via employee-owned assets.

Get PCI Certified

The truth is – a lot of the fraud that occurs is due to human error. Your customer support rep may reveal an account number during a live support chat or on social media. Another might give a login and password over the phone to somebody who claims to have forgotten theirs. All this can be avoided by establishing strict policies related to privacy and security, training employees in these policies, and providing regular refresher courses.