A Marketer’s Guide to Smarter Data Storage: Is Your Customer Data a Gold Mine or a Time Bomb?

We’re living in a golden age of data. Not only can you know how many people visited your site yesterday, but you can also buy data that tells you who they are, what they buy, and what other sites they frequent. This is amazing for marketers, as more and better data means more effective targeting. But with this bounty comes a huge challenge. You have to store all that data. You have to protect it. If you don’t safeguard it, you risk a host of repercussions – angry customers, costly lawsuits, and government intervention.

The more customer data you collect and purchase, the more you become a target for smart, determined hackers, and additional levels of burdensome oversight. This introduces a new risk to your business that is often ignored.  More is always better right?

Also Read: Distil Networks Enables Websites to Clean up Google Analytics for Free

Collecting information just because you can, may lead to more headaches than it’s worth. Marketers must think hard about what data they collect, how long they store it, how they will protect it, and whether or not they really need it. Here are the things to think about when making these important decisions.

Be sure the value of the data outweighs the added risk

It’s important to understand what types of data open up your organization to new risks. The main concern is Personally Identifiable Information (PII), which extends beyond name and address and can, in many cases, include zip codes, social security numbers, and even URL data. Storing PII requires adherence to government regulations, and opens organizations up to lawsuits if such data is stored improperly. Even worse, PII regulations vary wildly by country, and even by state.

The EU-US Privacy Shield frameworks are the best place to start, but they are not all-encompassing. In the US, the FTC is the primary organization overseeing the adherence of PII laws at a national level, but each state has its own jurisdictional requirements (yes, it is a huge pain). And keep in mind, these can be even more stringent than PCI requirements because they are government regulations, whereas PCI operates as an industry standard.

Most people view proper data storage as only a security concern, but if marketing teams are collecting this data, then they are responsible for introducing the risk.

Before collecting any new data, check with your security teams to make sure you have the proper procedures in place for handling it. And as a general rule of thumb, don’t store Social Security numbers. Not only does this data put a target on your back for hackers, but it opens your organization up to even larger liability. It’s just not worth it.

Don’t use email as a unique identifier

Thanks to recent, high-profile breaches, almost all internet users have had their email addresses compromised, leaving them vulnerable to resale on the dark web. Setting your own unique identifier gives your company an added layer of protection from potential breaches. This goes for login credentials as well as storage.

Ensure your security team requires each user to create a unique login that is not their email address. Yes, it will be a bit cumbersome, but they will be much angrier if their login credentials are stolen as a result of poor security protocol at the outset.

Also Read: Distil Networks Acquires Are You A Human to Build and Provide Stronger ‘Bad Bot’ Defense

Protect the data you must store

If storing PII is critical to your business, make sure your security and data teams take it seriously. They are likely familiar with the Privacy Shield framework mentioned above, but also check to make sure the following rules are in place:

• Any hashing that is done should not be reversible.
• Dictionary attacks (rainbow tables) against hashed values should be considered a threat.
• Encryption should be executed at the application level. Full disk encryption does not appropriately protect data and should not be considered a holistic encryption at rest strategy for servers.
• Never use proprietary encryption.  Use open standards that have been well-vetted, such as AES.  Make sure you use appropriate key lengths (256 or greater for symmetric and 4096 or greater for asymmetric).
• Any data feeds going in or out should be protected by using TLS 1.2 encryption in transit and/or symmetric encryption of the data before sending it.

Set realistic password options

Your users are human beings. If you force them to create passwords that use numbers, capital letters, and characters, but can only be 8 characters long, they’ll use P@ssw0rd1. They’ll also be more likely to reuse a password from elsewhere.  If you forget the characters, but force a longer password (say 16 characters) you are more likely to end up not only with a more secure password, but a unique one as well.  A phrase like ‘redlionchocolatefeet’ will take a computer billions of years to crack, making it secure, but it’s also easier for a user to remember and less likely to be re-used on multiple sites.

Also Read: Distil Expands Capabilities to Offer Bot Defense Solution for Websites, Mobile Apps and API Servers

Don’t be your own vulnerability

When you and your team log into internal systems to access data remotely, you could be your own biggest threat.  Are you using a unique password that can’t be stolen from a data breach on an external site?  Using a password manager like LastPass or OneLogin to generate a unique password for each site will make sure you don’t leave yourself open to the security missteps of other companies you have accounts with.

If you have the option, use multi-factor authentication tools like Authy or Google Authenticator to provide even more protection. Anytime you give a new employee remote access, you are also giving hackers a new potential way in. The IT security team is responsible for putting good systems and policies in place, but it’s your responsibility to ensure your team follows protocol.

Goldmine or time bomb?

Make data collection an active choice, not something that happens just because you can. Don’t collect or store data you do not need, that isn’t tied to a documented business justification, and is not retained for longer than you have a valid business need to do so. Make your privacy policies extremely transparent on what data you collect, how and why you use it, and with whom it may be shared.

Yes, a giant database of user data that you haven’t figured out how to use could be a potential goldmine, but it’s also a ticking time bomb. Make sure the tradeoff is actually worth it.

Recommended Read: TechBytes with Rami Essaid, Co-Founder and CEO at Distil Networks