News

Use of Live Customer Data in Application Testing Still Widespread

A survey released by Compuware Corporation and the Ponemon Institute shows "an overwhelming majority of organizations surveyed risk compromising critical information by using actual customer data for the development and testing of applications."

The report, The Insecurity of Test Data: The Unseen Crisis, says that 62 percent of companies surveyed use actual customer data instead of disguised data when testing applications. Of those companies, 89 percent use customer files and 74 percent use customer lists. The report notes that live data often includes "employee records, vendor records, customer account numbers, credit card numbers, Social Security numbers, and other credit, debit, or payment information."

Developers may believe that test data is immune from privacy threats because they are testing in a non-production environment, but the survey points out that such environments are usually less secure than their production counterparts. It also notes that testing data may be exposed to such unauthorized sources as in-house testing staff, consultants, partners, and offshore personnel. Over half (52 percent) of respondents say they outsource their application testing, and 49 percent of those respondents shared live data with the outsourced company.

"For many organizations, large customer data files represent an easy, cheap source of data to use when testing applications, but this process introduces a huge element of risk to the challenge of maintaining the integrity of sensitive information, particularly when third parties and offshore resources are involved," said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. "This study points to a need for greater awareness and accountability over how sensitive data is used within organizations. Common practices as they relate to all uses of live data must be evaluated to assess risk, and safeguards implemented to ensure data security."

The survey reports that half of the companies using actual customer data in testing don't protect that information. Some 897 IT professionals participated in the survey; they averaged ten years experience.

Among the other findings:

  • Half (50 percent) of respondents have no way to know if the test data had been compromised

  • Over four in ten respondents (41 percent) do not protect live data they use when developing software

  • Over a third (38 percent) were unsure if the live test or development data used in their organization had had been lost or stolen

  • More than one-fourth of respondents (26 percent) didn't know who was responsible for protecting test data (26 percent thought it was the development team, 21 percent thought the testing organization was responsible)

"Few people realize how much is at risk during the development and testing of applications," said John Williams, senior vice president, product solutions, Compuware. "All commercial organizations -- not just health care and financial institutions -- have an obligation to protect the privacy of consumer data. To eliminate the test data security risk, an increasing number of our clients are using our Test Data Privacy solution that provides them with an automated, repeatable process for creating safe and effective test data."

About the Author

James E. Powell is the former editorial director of Enterprise Strategies (esj.com).

comments powered by Disqus

Featured

  • Compare New GitHub Copilot Free Plan for Visual Studio/VS Code to Paid Plans

    The free plan restricts the number of completions, chat requests and access to AI models, being suitable for occasional users and small projects.

  • Diving Deep into .NET MAUI

    Ever since someone figured out that fiddling bits results in source code, developers have sought one codebase for all types of apps on all platforms, with Microsoft's latest attempt to further that effort being .NET MAUI.

  • Copilot AI Boosts Abound in New VS Code v1.96

    Microsoft improved on its new "Copilot Edit" functionality in the latest release of Visual Studio Code, v1.96, its open-source based code editor that has become the most popular in the world according to many surveys.

  • AdaBoost Regression Using C#

    Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the AdaBoost.R2 algorithm for regression problems (where the goal is to predict a single numeric value). The implementation follows the original source research paper closely, so you can use it as a guide for customization for specific scenarios.

  • Versioning and Documenting ASP.NET Core Services

    Building an API with ASP.NET Core is only half the job. If your API is going to live more than one release cycle, you're going to need to version it. If you have other people building clients for it, you're going to need to document it.

Subscribe on YouTube