Website Security

Website security is something that even the biggest and best companies struggle to get right at times (in the last 18 months Adidas, Macy’s, Delta, Under Armour and Forever 21 have all experienced a data breach). However, it is really important that you get it right – a recent KPMG survey revealed that 19% of customers would completely stop using a retailer if they found out they’d had a breach. Some of the key things to consider are:

• Payment Card Industry Data Security Standards (PCI DSS compliant) – your software and hosting will need to meet these standards if you want to take Mastercard, American Express, Visa or Discover credit cards. You only need this if customer credit card data actually flow through site – as opposed to being submitted directly to a third party payment system such as Paypal. Using a third party company reduces the security risk around card payments, but it doesn’t exclude a business from PCI DSS compliance. Your payment provider should provide you with information that clearly states what their own responsibilities are in order for you to assess your compliance, which you do by completing a Self Assessment Questionnaire
• Transport layer security (TLS) – an encryption protocol used to secure communications over the internet (TIP: If a web address doesn’t start with https:// it doesn’t use TLS!). TLS is required for PCI compliance, but it doesn’t in itself make you PCI DSS compliant.
• ISO 27001/27002/27018 – these are internationally recognised frameworks for website security. Whilst they aren’t mandatory, it’s a good idea to look out for providers which have them as they do provide you with additional comfort over the security your provider has in place.