Practical protection.
THE MEASURES
HTTPS across the whole site Strong unique passwords and two-factor authentication on anything holding data Administrator accounts only for people who need them Software kept updated Backups, stored securely
NEVER STORE CARD DETAILS
Use a hosted payment gateway. There is no legitimate reason for a small business site to hold card numbers.
EXPORTED DATA
A customer list downloaded as a spreadsheet must not sit in a web-reachable folder.
Anyone guessing the URL takes it.
Keep exports off the server, in access-controlled storage, and delete them when finished.
BACKUPS
They contain everything your database does, including customer data.
Protect the storage accordingly, and encrypt where your tool supports it.
WHO HAS ACCESS
A developer with access to your site has your customer database.
Consider that when granting access, and revoke it when work ends.
IF THERE IS A BREACH
Contain it, establish what was exposed, open a ticket with us, and take advice on notification obligations.
Tell affected people honestly.
