Crash test dummies

UK firm put valid data into prototype systems

By John Leyden • Get more from this author

Posted in Security, 4th July 2006 12:13 GMT

Free whitepaper – Securing your online data transfer with SSL

Many firms are using live customer data to test applications.

Almost half (44 per cent) quizzed in a UK survey admitted they used valid information to run systems through their paces, a practice that leaves them potentially liable under the Data Protection Act (DPA), which prohibits organisations from using data for purposes other than those for which it was collected.

The survey, of 100 IT directors, commissioned by enterprise software firm Compuware, found ignorance about data protection legislation was rife among IT directors. Although the DPA was set up in 1998, 48 per cent of senior IT decision makers admitted to only being "vaguely familiar" with the legislation.

Compuware reckons data privacy issues have grown harder for organisations to manage over recent years with the greater use of outsourcing.

"Unless they [enterprises] have rigorous procedures in place, they run the risk of live data being leaked to third parties. This can have severe repercussions on customer confidence and company reputation, and ultimately affect the bottom line," Compuware worldwide enterprise solutions director Ian Clarke said.

The common sense answer to data protection concerns is to use fictional data. However, desensitising data might invalidate some data input fields so an application is not properly tested. Compuware suggests a better approach is to disguise data by exchanging known values, such as addresses, with dummy data in the same format. ®

Free whitepaper – Vulnerability management buyer's checklist