Business
UK’s top financial services organisations still collecting PII insecurely in the run up to GDPR, discovers RiskIQ
Published by Gbaf News
Posted on May 23, 2018
Global Banking and Finance Review
Company
Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website.
Published by Gbaf News
Posted on May 23, 2018
Research finds 27 percent of sites that capture Personally Identifiable Information (PII) are doing so insecurely, potentially breaching GDPR guidelines
With the EU General Data Protection Regulation (GDPR) coming into effect on May 25, RiskIQ, the digital threat leader, has discovered that one in nine PII capturing websites belonging to the top 10 UK financial services organisations are doing so without adequate security measures, potentially breaching GDPR guidelines.
Across 28,991 active websites, RiskIQ research found that out of 1,245 sites capturing PII through data entry points accessible by site visitors, 27 percent of these sites (342 sites) are capturing PII insecurely. This equates to an average of 34 sites per organisation.
A PII capturing website is one which accepts user input that can identify an individual. Examples of PII include input data such as name, address, date of birth, and email address. This also extends to pages with iframes and pop-up windows that populate during a browser session and accept data. RiskIQ identifies these by referencing the Document Object Model (DOM) of each page of a website. This method is language agnostic and identifies PII capture regardless of site language.
RiskIQ research found:
Insecure sites are defined as those websites that capture data in clear text using the http protocol, or sites with certificate issues, such as expired certificates, misconfigured certificates or using old and untrusted certificates. The findings highlight one of the key challenges businesses face in the protection of PII, as required by GDPR.
“Companies that haven’t already implemented encryption for all collection and transmission of personal information will have missed the boat in order to comply with the fast-approaching regulation,” said Fabian Libeau, VP EMEA at RiskIQ. “Now more than ever companies need to be aware of their digital footprint. With the ever-expanding number of PII touch points, it’s crucial companies ensure they are tracking all of their digital assets and consistently monitoring for weaknesses in their handling of personal information.”
Research finds 27 percent of sites that capture Personally Identifiable Information (PII) are doing so insecurely, potentially breaching GDPR guidelines
With the EU General Data Protection Regulation (GDPR) coming into effect on May 25, RiskIQ, the digital threat leader, has discovered that one in nine PII capturing websites belonging to the top 10 UK financial services organisations are doing so without adequate security measures, potentially breaching GDPR guidelines.
Across 28,991 active websites, RiskIQ research found that out of 1,245 sites capturing PII through data entry points accessible by site visitors, 27 percent of these sites (342 sites) are capturing PII insecurely. This equates to an average of 34 sites per organisation.
A PII capturing website is one which accepts user input that can identify an individual. Examples of PII include input data such as name, address, date of birth, and email address. This also extends to pages with iframes and pop-up windows that populate during a browser session and accept data. RiskIQ identifies these by referencing the Document Object Model (DOM) of each page of a website. This method is language agnostic and identifies PII capture regardless of site language.
RiskIQ research found:
Insecure sites are defined as those websites that capture data in clear text using the http protocol, or sites with certificate issues, such as expired certificates, misconfigured certificates or using old and untrusted certificates. The findings highlight one of the key challenges businesses face in the protection of PII, as required by GDPR.
“Companies that haven’t already implemented encryption for all collection and transmission of personal information will have missed the boat in order to comply with the fast-approaching regulation,” said Fabian Libeau, VP EMEA at RiskIQ. “Now more than ever companies need to be aware of their digital footprint. With the ever-expanding number of PII touch points, it’s crucial companies ensure they are tracking all of their digital assets and consistently monitoring for weaknesses in their handling of personal information.”