Best Practices on Security for Online Panels
posted by: Nick Roman on 3/1/2010
In my previous blog entry I discussed the potential implications of security holes in panelist portals. Today, I will follow up with some advice on what measures you should take to ensure your panelists' data is safe and secure.
1. Enforce a strong password policy. You cannot trust your panelists to choose strong passwords. A strong password policy may involve a combination of elements like:
• Forcing a minimum number of uppercase characters, forcing a minimum number of non-alpha characters (characters that are not letters) and non-alpha numeric characters (characters that are neither letters or numbers).
• Forcing password length.
• Force passwords that are not similar to username.
2. Enforce a password change policy. Elements to consider:
• Passwords should expire after a certain time, after which the panelist will be forced to select a new password on login.
• The new password should be different from the last X number of passwords used.
• Force the panelist to have to wait for a certain period after changing the password before being allowed to change it again.
3. Passwords should never be transmitted or stored in clear text:
• Always use HTTPS on login.
• Passwords should be hashed (one-way encrypted), and never be stored in plain text.
• Do not send plain text passwords to panelists.
4. Ensure that the system you are using has been submitted to Security Testing ("ethical hacking") to detect and fix vulnerabilities like
SQL injection and
cross-site scripting (XSS). If you are relying on an internally developed system, I would recommend getting security expertise to verify the security of your system. If you use a commercial panel solution, I recommend that you check that your provider can document that their system has regular security testing performed.
The password policy may obviously make things a bit more complicated for your panelists, but this can be reduced with good "forgot password" functionality (which should not be sending passwords in plain text!).
The sensitivity of the data that anyone running an online panel is handling, makes security a too important issue to ignore.