The California Consumer Privacy Act (CCPA), which dictates how companies and organizations need to secure the data of users, could drive heavy fines against sites that fail to protect against these attacks. The act can also be a positive force to drive major improvements in your web application security approach.
Why Website Issues Are a CCPA Risk
While the CCPA is the strongest state consumer privacy legislation in the United States, the law also has global reach. A French or a Chinese company that has customers, partners, service providers, or offices in California could be fined if its website is breached and California residents are affected.
However, the exposure is broader than data breaches. CCPA extends liability for compromises of user data to third-party services that web application publishers and operators use. This can include payment processors, chatbot operators, and any other provider of third-party services that integrate with web applications. This could mean large financial exposure if California, which has a track record of aggressive enforcement, pursues fines.
CCPA also sets up a provision under which people whose data is stolen can sue businesses “as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.” This is a broad mandate to litigation in the event of any type of security incident.
The upshot? CISOs, CMOs, site reliability engineers, and CROs at companies with even small exposure to California should care about liabilities conferred by CCPA on web applications and site code.
Having trouble tracking what third-party services and code companies use complicates auditing for CCPA liabilities. Worse, when third-party libraries and services are hacked or suffer security breaches, the owners of these third-party elements may not notify all website owners that use these libraries and services promptly. The PerimeterX survey found that 42% of respondents have no way to know when and if their site code was changing without their proper authorization.
How to Reduce Risks from Third Parties
Some basic steps can significantly reduce your risk, or, at a minimum, show you performed solid due diligence into the risks third parties confer on your organization (and by extension, on your customers). First, identify all instances of third-party code running on your site. If this code is from third-party open source libraries, then you must treat it as if it’s your own code and analyze it for security risks. This includes static code analysis.
- Do you capture our user data in any way? If yes, please give a detailed explanation how you capture this data.
- If you capture our data, who has access to that data (additional parties) and how is it secured?
- How are you checking your code for unauthorized changes? (They should be able to give you a list of steps such as static code analysis and live application scanning.)
- Do you have full (not partial) SOC 2 or ISO 27001 compliance?
The best offense against CCPA, however, is a good defense. To that end, verify that all your public-facing applications and APIs are properly locked down. All public apps must be guarded by firewalls and other security measures with updated configurations.
Even if the script is actually a legitimate and uncompromised library or service, compliance rules around data gathering and ability to provide any information on how data is used mandate that site operators must be able to identify every third-party that has access to data, in any way, shape, or form.
Ido Safruti is a co-founder and CTO at PerimeterX, provider of application security solutions that keep businesses safe in the digital world, detecting risks to web and mobile applications and proactively managing them. Previously, Ido headed a product group in Akamai focused … View Full Bio