One in nine PII capturing websites belonging to the top ten UK financial services firms are doing so without adequate security measures, potentially breaching new data protection rules, the European Union-wide General Data Protection Regulation (GDPR), according to RiskIQ, a digital threat software firm.
Across 28,991 active websites, RiskIQ found that out of 1,245 sites capturing PII through data entry points accessible by site visitors, 27 percent of these sites (342 sites) are capturing PII insecurely. This equates to an average of 34 sites per organisation, the software developer adds.
A PII capturing website is one which accepts user input that can identify an individual. Examples of PII include input data such as name, address, date of birth, and email address. This also extends to pages with iframes and pop-up windows that populate during a browser session and accept data. The company identifies these by referencing the Document Object Model (DOM) of each page of a web site. This method is language agnostic and identifies PII capture regardless of site language.
Also found:
Out of 3,101 public websites with a login page, 294 of these sites (9.4 percent) capture login information insecurely
Out of 320 sites capturing PII through data entry fields accessible by site visitors, 124 (39 percent) are capturing PII insecurely
Insecure sites are defined as those websites that capture data in clear text using the http protocol, or sites with certificate issues, such as expired certificates, misconfigured certificates or using old and untrusted certificates. The findings highlight one of the key challenges businesses face in the protection of PII, as required by GDPR.
Fabian Libeau, VP EMEA at RiskIQ said: “Companies that haven’t already implemented encryption for all collection and transmission of personal information will have missed the boat in order to comply with the fast-approaching regulation. Now more than ever companies need to be aware of their digital footprint. With the ever-expanding number of PII touch points, it’s crucial companies ensure they are tracking all of their digital assets and consistently monitoring for weaknesses in their handling of personal information.”
Visit www.riskiq.com.
