4 ms·
It's still a broken process. Are you going to re-audit every future change to your web site? I doubt it. The default, as the article suggests, should be to red
by joosters 9y ago
It's still a broken process. Are you going to re-audit every future change to your web site? I doubt it.
The default, as the article suggests, should be to redact all fields, then let the company opt-in the fields that they really mean to record.
- kevinconroy 9y agoIf a company is serious about security and privacy, they have to do those audits for every feature, regardless of if they use these tools. PCI requires this if you handle money online. Still, you're right that many companies have a surprising lack of security. This vector of unintentional exfiltration may pale in comparison to the intentional mismanagement and lack of security focus internally. Equifax, anyone?