Listen to your Customers
Tesco plc has been in the news in the last couple of weeks regarding security of its ecommerce web site and how this has now escalated into an investigation by the ICO.
Passwords are stored in a secure way. They're only copied into plain text when pasted automatically into a password reminded mail.
Troy Hunt, security expert and generous contributor to application security community, reported his concerns at the end of July. The issue seems to have rolled on, and on, and and on. So it looks like there are at least password storage and cross-site scripting problems — two of the bare minimum OWASP Top Ten.
It appears Tesco has not taken application security seriously, and it has also managed to make matters worse by how it responded to valid enquiries from its customers and feedback via Twitter. Were these enquiries dealt with under an incident response plan? It seems unlikely. But this type of disregard for application security and failure to recognise valid feedback from customers is common. And, it is not limited to the UK retail sector. This isn't good enough.
Listen to your customers. Some of them might actually be trying to help you. For free. And they're not all muppets, whatever your corporate culture believes.
Posted on: 21 August 2012 at 07:57 hrs
Comments are filtered automatically and should appear shortly after they been checked.
http://www.techweekeurope.co.uk/news/tesco-securit...