What customers require of you.
WHAT YOU ARE HOLDING
Other organisations' data, on their behalf.
WHAT FOLLOWS
Your security failure is their breach.
WHAT TO IMPLEMENT AS A BASELINE
Encrypted connections everywhere Passwords stored using a modern hashing function Two-factor authentication, available to all Role-based permissions Audit logging Session management and revocation
WHAT TO NEVER DO
Store passwords recoverably Send passwords by message Log credentials or tokens Use the same credentials across environments
WHAT ADMINISTRATIVE ACCESS REQUIRES
Restriction to few people Separate accounts Logging of everything done Justification for accessing customer data
WHY THAT LAST POINT
Staff browsing customer data is a real and common failure.
WHAT TO BUILD
A support access mechanism that is logged and time-limited.
WHAT DEPENDENCY MANAGEMENT REQUIRES
Scanning for known vulnerabilities A process for urgent updates
WHY
Most of your code is other people's, and their vulnerabilities are published.
WHAT TO TEST
Authorisation on every endpoint, as every role.
WHAT TO PREPARE
An incident response process, before an incident.
WHAT CUSTOMERS WILL ASK FOR
A security questionnaire completed Evidence of practices Sometimes, an independent assessment
