Website security: data protection
In this, the fourth in the web security series, we examine what is involved in securing the data you collect.
You’ve created a data capture form. You’ve protected it from evil bots. You’ve let it loose in the wild, and people have used it. Now you’ve collected that data, you need to look after it.
The General Data Protection Regulation (GDPR) will be familiar to many people, at least in name. One of its tenets is that any data you hold on people must be stored securely. In practice, this means ensuring your web application and systems are secure.
It means:
- Ensuring that both server and application software are up to date with the latest security releases and are properly configured
- Ensuring that only people who should have access to the data have access to it
- It is inaccessible to robots and crawlers
Safely storing sensitive data
“Sensitive” data might include things such as medical or financial data about people. If you have sensitive data, the rules are still the same: make sure it is stored securely, and control who can access it. Ultimately, you should treat any and all personal data as sensitive, and take appropriate measures to protect it.
Sensitive data should not be confused with “special category data”, which has its own rules as defined by GDPR: basically, avoid it where possible.
Nor should it be confused with one’s obligations under the PCI (Payment Card Industry) regime: credit card data gets its own set of rules, and warrants its own separate treatment.
Any data you hold on people must be stored securely.
Access control and discovery
Sometimes, you may wish to publish content to the internet which is only for the consumption of a certain set of people. A common requirement might be to have a page only discoverable by URL.
Although it is possible to simply publish a page, one must consider the ways such a page may be discovered, for example:
- Site search
- Site menus
- Listings pages
- Sitemaps
- XML sitemaps (for search engines)
- Third party search engines such as Google, Bing or others.
Although it is possible to control and disarm ways 1 to 5, the last item is more difficult. All the search engines will need is a single link from somewhere on the internet and then they can find your page. Therein lies the difficulty: you can make sure no links to your page exist on your site, but you cannot control whether any exist throughout the rest of the internet.
Ultimately, Drupal provides the best method of access control: user accounts, roles and permissions. If a piece of content is restricted to those with certain permissions, it will not even appear on menus for those users without the necessary role.
When you’ve got your web application security on lock, your data secure, and your forms protected, you may consider your job done. Alternatively, you may wish to test your defences.
Next episode: penetration tests and security scans.
Read the other blogs in our Security Series:
Are you concerned about the security of your Drupal site?
Talk to us about conducting a website security audit.
Anthony Lindsay Director of Managed Services
With decades of experience, Anthony leads the Annertech Managed Services Team, delivering top quality design, development, and, ultimately peace-of-mind services to all of Annertech's wonderful clients.
