Tonight I had to stop in to buy a bottle of wine from our local superstore and was made a very attractive offer on a product if I signed up to the retailers club.

Normally I refuse all loyalty schemes, I read 1984 when I was a teenager and I loath being tracked by anyone, but the offer did seem rather good so I agreed.

So the assistant drags me away from the cash register (if that seems like a dumb idea thats because it is) and starts asking me all these detailed questions, full name, Date of Birth, address, email and phone number. etc….

I didn’t get to the bottom of the screen before I ended up saying sorry I don’t want your card you don;t need all this data, just sell me the product.

I refuse to give you all this data for a loyalty scheme but the system had been designed so that it refused to process anything without the full data.

My comment to the worker was that one day you will get hacked and when you do the hackers could easily carry out identity fraud with the data you are collecting.

Increasingly that is my response to people who collect more data than they need to do the job.

It really pisses me off.

In fact all they needed was an email address or a mobile phone. Either of which would have been perfectly good to market to me and provide a discount at the checkout and i would have been happy to have joined.

But instead some marketing muppet has designed a system that took 2-3 minutes for the assistant to sign up someone in a busy store and required significantly more data than they needed to market to me.

To add insult to injury the PC based system was sitting in full customer view and accessible at the front desk.

In my mind the question is not will they get hacked, the question is when?

They are a privacy breach waiting to happen.

Numerous times in the last few months I have had the occasion to think about and discuss data security and privacy.

The first was in the Telstra ICT Industry Advisory board meeting where it was discussed at length.

The GM of Operations for Telstra said he only worries about 3 things. Security, Security and Security.

Nothing else matters to him, however most startups don’t really think about data collection and security in the same regard.

Interesting Telstra is using Blockchain algorithms to ensure configurations on their telco/data switches and routers are not compromised which is a really cool application.

The operating system code for the network device is signed with Blockchain modified code base and is verifiable as the original code, any changes to the system no longer match the blockchain which triggers an alert and action can be taken immediately.

A conversation had by chance with Phil Morle at Pollenizer about who has control of your health records also started me thinking that Blockchain verified databases have a big future for tracking copies of data.

For example if you go to a Doctor who orders an Xray or bloodtest. What happens to that data, who has a copy, where is it stored? When is it destroyed? None of this is currently known or verifiable.

It started me thinking about a set of principles by which Startups could create a culture around good data collection, security, privacy and loss prevention and mitigation.

Data Guidelines

So it got me thinking and I have come up with a few guidelines for collecting data.

• We should assume everyone is going to get be hacked at some point.
• Do you absolutely need to collect all data items to provide the service? Anything is which is not absolutely essential to provide your service should not be collected (this is enshrined in Australia Privacy Law but Im not sure anyone but health providers and financial services providers pay any attention to that).
• Don’t collect or retain credit card or financial information, there is absolutely no reason to, Paypal or other gateways can provide you methods to allow them to store data on your behalf and provide you a proxy or nonce for tracking payments which is not identifiable. I can’t think of any reason a startup would want to retain financial information.
• Don’t collect data of birth, social security, tax file numbers or address unless you absolutely can’t deliver your service without the data or there is a Government requirement to do so.
• Start with collecting first name and email address only, vigorously defend any attempt to widen the amount of data you collect only do so in the face of evidence it is required to run the business.
• Beware of collecting data which is health related or personal private data, most countries have requirements which require special provider registration and compliance if you collect this type of data, so avoid collecting this data like the plague.
• Don’t ask your users to fill out any more fields than they have to, its a pain in the ass and most people hate it and Im sure the dropout rate is significant for forms with unreasonable data requests.
• Each Country has different laws on data collection and retention, you should know them.
• Encrypt all data, disks, connections.

Basically the rule here is avoid collecting data.

You just don’t need the risk, collect only the 1-2 pieces of data you absolutely need and reject the rest so that when you are hacked (and you will be) they will only get a small amount of non essential data.

Image credit https://en.wikipedia.org/wiki/Anonymous_(group)#/media/File:Anonymous_at_Scientology_in_Los_Angeles.jpg

In the last few weeks there have been some spectacular hacking stories that have provided fantastic entertainment assuming you that you were not one of the victims.

The hacking of Ashley Maddison including the theft and public disclosure of the entire 33 million strong customer list and essentially all operational and company data and files is the most entertaining tech story this year.

This is the story that just keeps on giving.

Ashley Maddison is the site with the business model that encourages and facilitates cheating on your wife.

I use the term “cheat on your wife” loosely for two reasons, firstly its becoming pretty clear that only a small portion of the 33 million users were actually real females and the men were chasing ghosts.

Secondly a large % of the chat activity on the site was allegedly conducted by an Army of 77,000 Fembots who were programmed to make sort of meaningful conversation with the men.

I’m not sure this is what they meant in Startup school when they talk about scaling your business up.

The size and audacity of the deception and the fact that the bots were designed to speak different languages as well blows me away.

According to numerous analysts including veteran security expert John McAffee almost none of the men who used Ashley Maddison got laid.

Annalee Newitz, a reporter for Gizmodo, writing that there were “at most, about 12,000 of these profiles” that seemed to belong to women who were active on the site however she has since recanted on that claim but still maintains there is 77,00 Fembots .An updated version of the story has just released here.

I guess no one should be surprised that a website setup to encourage cheating on your husband or wife is also cheating on its customers in a pretty incredible way.

The biggest shock for the users was that a lot of them were paying to remove their account names from the database but Ashley Maddison didn’t actually delete the data.

According to John McAfee in a later article he makes the assessment that the Ashley Maddison Hack was performed by a sole female employee who had access to everything in the company and took the lot.

According to Ashley Madison they have had a massive signup rate since the hack got their startup global media attention for week so maybe the breach is working out for them.

Lessons

Startups can learn a lot from this hack;

• Your data is just as likely to get hacked or stolen from inside as outside and the inside hack will probably be more damaging due to their internal access.
• No one in your startup aside from founders should have access to all company data (even that is questionable), no one should have the keys to the vault.
• Data, services, machines and applications should be partioned where possible and access provided to employees on a need to know basis only.
• You should assume you will get hacked at some point.
• Encryption should be the default setting for all data.
• Encrypt data in transit (SSL/TLS)
• Encrypt data at rest (individual files, databases, volumes or tables/fields)
• Encrypt via your application or via system level
• Minimise the data you collect to the barest essential fields. If you don’t collect unnecessary data you have reduced your risk when the inevitable hack occurs.
• Its worth considering solutions that enable some form of revocable data keys so if data gets into the wild the encryption key can be disabled.
• Force strong passwords
• Keep your systems patched and maintained
• Keep your portable devices locked and enable remote delete mode