Data security in a business system: 8 principles to ask your developer about
A business system holds data about your customers, employees and finances. Security is not an add-on you can bolt on at the end. These principles are worth discussing with your developer right at the start.
8 security principles
- Least privilege. Each user has access only to what they need.
- Secure sign-in. Strong passwords, a lockout after repeated failed attempts, and an extra sign-in confirmation for important accounts.
- Encrypted connection. Data sent between the user and the system is encrypted.
- Backups. Made automatically, stored in a different location from the system, and checked regularly.
- Change history. The system records who changed important data and when.
- Updates. The server and libraries are updated regularly.
- Error monitoring. Problems are caught before users notice them.
- Employee offboarding procedure. Access is revoked immediately and tasks are handed over.
A backup nobody has tested is not a backup
The most common mistake is backups that run for years without anyone ever trying to restore the system from them. It is worth running a restore test regularly and recording the result.
Personal data
Business systems process personal data of employees and customers. From the start, agree on which data is really needed, who has access to it and how long it is kept. Legal questions, including GDPR, are best discussed with a lawyer or a data protection officer.
Questions to ask your developer
- How are backups made, and when was a restore last tested?
- Who has access to the server and production data?
- How are the system and its libraries updated?
- What happens when an incident is detected?
If you would like to talk about a secure system for your company, book a consultation.
Have a question on this topic? Let’s talk →