UK’s top financial services organisations still collecting PII insecurely in the run up to GDPR, discovers RiskIQ
May 22, 2018
Research finds 27 percent of sites that capture Personally Identifiable Information (PII) are doing so insecurely, potentially breaching GDPR guidelines
LONDON, UK – May 22, 2018 – With the EU General Data Protection Regulation (GDPR) coming into effect later this month, RiskIQ, the digital threat leader, has discovered that 1 in 9 PII capturing websites belonging to the top 10 UK financial services organisations are doing so without adequate security measures, potentially breaching GDPR guidelines.
Across 28,991 active websites, RiskIQ research found that out of 1,245 sites capturing PII through data entry points accessible by site visitors, 27 percent of these sites (342 sites) are capturing PII insecurely. This equates to an average of 34 sites per organisation.
A PII capturing website is one which accepts user input that can identify an individual. Examples of PII include input data such as name, address, date of birth, and email address. This also extends to pages with iframes and pop-up windows that populate during a browser session and accept data. RiskIQ identifies these by referencing the Document Object Model (DOM) of each page of a web site. This method is language agnostic and identifies PII capture regardless of site language.
RiskIQ research found:
- Out of 3,101 public websites with a login page, 294 of these sites (9.4 percent) capture login information insecurely
- Out of 320 sites capturing PII through data entry fields accessible by site visitors, 124 of these sites (39 percent) are capturing PII insecurely
Insecure sites are defined as those websites that capture data in clear text using the http protocol, or sites with certificate issues, such as expired certificates, misconfigured certificates or using old and untrusted certificates. The findings highlight one of the key challenges businesses face in the protection of PII, as required by GDPR.
“Companies that haven’t already implemented encryption for all collection and transmission of personal information will have missed the boat in order to comply with the fast-approaching regulation,” said Fabian Libeau, VP EMEA at RiskIQ. “Now more than ever companies need to be aware of their digital footprint. With the ever-expanding number of PII touch points, it’s crucial companies ensure they are tracking all of their digital assets and consistently monitoring for weaknesses in their handling of personal information.”
About RiskIQ
RiskIQ is the leader in digital threat management, providing the most comprehensive discovery, intelligence, and mitigation of threats associated with an organisation’s digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social, and mobile exposures. Trusted by thousands of security analysts, RiskIQ’s platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk, and take action to protect business, brand, and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners, and MassMutual Ventures. Visit RiskIQ.com or follow us on Twitter.
Try RiskIQ Community Edition for free by visiting https://www.riskiq.com/community/. To learn more about RiskIQ, visit www.riskiq.com.
###
© 2018 RiskIQ, Inc. All rights reserved. RiskIQ is a registered trademark of RiskIQ, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners.
PR contact
Richard Scarlett, Gemma White, Gabriel Hedengren
Finn Partners, on behalf of RiskIQ
Email: riskiq@finnpartners.com
Phone: 020 7017 8421