The Federal Trade Commission publishes “Start with Security: A Guide for Business” & offers these recommendations for business:
-
Don’t collect personal information you don’t need.
-
Hold on to information only as long as you have a legitimate business need.
-
Don’t use personal information when it’s not necessary.
-
Restrict access to sensitive data.
-
Limit administrative access.
-
Insist on complex and unique passwords.
-
Store passwords securely.
-
Guard against brute force attacks.
-
Protect against authentication bypass.
-
Keep sensitive information secure throughout its lifecycle.
-
Use industry-tested and accepted methods.
-
Ensure proper configuration.
-
Segment your network.
-
Monitor activity on your network.
-
Ensure endpoint security.
-
Put sensible access limits in place.
-
Train your engineers in secure coding.
-
Follow platform guidelines for security.
-
Verify that privacy and security features work.
-
Test for common vulnerabilities.
-
Put it in writing.
-
Verify compliance.
-
Update and patch third-party software.
-
Heed credible security warnings and move quickly to fix them.
-
Securely store sensitive files.
-
Protect devices that process personal information.
-
Keep safety standards in place when data is en route.
-
Dispose of sensitive data securely.