Security And Compliance in Australian Ecommerce Hosting
For an online shop to be available at the point of sale, to have its legal obligations in order and to see that customer information is safe, it needs proper security and compliance from its Australian host. A good one will provide for incident response, backups, payment and privacy; secure Australian ecommerce hosting can support these needs, but it will not, however, put a business in compliance while you are off boiling the billy.
My name is Thomas Rourke. I put together no-nonsense guides for businesses wanting straight answers free of technical obfuscation. In what follows I cover the Privacy Act 1988 (Cth), APPs, PCI DSS, data residency in Australia and the sort of hosting features that mitigate risk in the day to day running of an online retail operation.
The Nature of Security And Compliance
Compliance is a matter of adhering to the contractual and legal dictates on how your business is to handle information. Security is what protects the personal data from the time it is collected, stored, processed or transmitted through to its deletion.
The two are not synonymous even if they overlap. You can have a store that is secure in a technical sense with a flimsy breach response plan or a consent process that is anything but clear. On the other hand, do not think a well put together compliance document is going to put an attacker off when access controls are rough as guts.
Uptime Is Not All There Is To Security
Of course website availability is important, especially in the run up to a sales campaign, but for an Australian business there is more to ecommerce data security than uptime. Your host ought to be able to tell you about its approach to vulnerability testing, account permissions, firewalls, malware, backups and the patching of operating systems.
Then there is the question of compliance: is the use and collection of information by the business done lawfully and transparently? The host has its part to play in providing controls, but the onus is on the business for its own applications, staff and third parties.
Online Privacy Laws
Most organisations in Australia dealing with personal information will come up against the Privacy Act 1988 as the federal framework. The Australian Privacy Principles underpin this and establish what is to be expected in terms of security, disclosure, notice, use and so forth.
There is the $3 million annual turnover figure that is commonly cited, but one should be aware of the exceptions to the rule, such as some health service providers or those in the trade of personal information.
Make Sure You Are Covered
A small online enterprise should not be taken for granted as being beyond the reach of the Privacy Act 1988. How you go about handling customer data and the services you put on offer may be as relevant as your turnover. State and territory laws are another consideration for certain sectors, notably where health information is involved. When in doubt have a qualified privacy professional look over your obligations. For the definitive word on the Privacy Act and APPs the Office of the Australian Information Commissioner is the place to go.
Customer Data Under The APPs
Ecommerce businesses make use of 13 principles that form a workable framework for determining who can have access to what information and why. Personal information for an online store is not just a name and email, it can be an IP address, device info, credentials, a phone number, delivery details and what has been purchased. Sensitive data is something else again in the eyes of the law and poses more of a risk, so it is not wise to be casual in its collection.
Explain What You Do And Collect Only What Is Necessary
If the transaction does not call for a date of birth or demographic detail then leave it off the checkout form and do not ask for preferences that have no bearing. Each additional field is more to have to delete, retain and secure down the line. Should you require such information, give a reason for it.
Your privacy policy must be consistent with the reality of the site, be it in respect of analytics, fraud prevention or the like. It lays out the types of data you are after, the purpose, any overseas handling, disclosures and the means for a customer to lodge a complaint or seek correction.
PCI DSS In Practice
The Payment Card Industry Data Security Standard applies to any environment where payment card data is stored or passed on. So PCI DSS for ecommerce hosting is as much about the payment journey as it is about having a padlock on the page.
One can lessen the risk of card-data by employing a payment service of repute to take care of the details and return a token to your store. Yet that is not an absolution of all responsibility; integrations, plugins and administrator accounts still have to be safeguarded.
Limiting Card Data Exposure
There is no place in an ecommerce database for full payment card information unless a sound business case exists and the right controls are in place. While you can have a secure configuration with Shopify, WooCommerce or Magento, do not mistake the platform for a compliance certificate.
Find out from your host and payment provider where their duties end and yours begin. Put to one side any assumptions that a well put together payment page is not riddled with poor configuration; check for hosted fields, tokenisation, secure redirects and the documentation to back up your compliance.
Is Australian Hosting a Necessity?
Not every ecommerce operation is bound by data residency laws in Australia. There may be commercial merit to using an Australian data centre but that does not in itself guarantee the security of customer data or fulfil legal requirements.
With cloud hosting one has to consider the primary server, backups, support tools, the payment provider and monitoring systems, all of which could be in different places, with data being accessed from abroad. Do not be swayed by a “local” sales badge, go through the data-processing terms of the provider.
Weighing Location Against Protection
An Australian host will serve latency, procurement and contractual needs as well as set the right expectations with customers and make the provider’s arrangements more straightforward for an Australian business to follow.
Then again, a local server that is not well run will not have the same security controls as an overseas alternative. One should look at encryption, how incidents are notified, access logging, the deletion process, subcontractors and the like. Your obligations and risk profile, not some flag on the homepage, will tell you what is best.
What To Expect From Hosting Security
Any arrangement for an online store ought to show plainly how it is protected. “Enterprise-grade security” is just marketing in a hi-vis vest if there is no evidence to support it.
The controls put in place need to cover the website and the hosting account and those who run them. They must stand up to a staff change, a surge in traffic or an 11.58 pm plugin update of sorts.
Provider Controls Under Scrutiny
SSL/TLS certificates are there to guard data in transit from the browser to the site. Multi-factor authentication is a safeguard for administrator accounts in the event of a password being compromised or used in another context. Firewalls and network segmentation can be of service in keeping unwanted traffic at bay.
Inquire as to whether the provider will put in place audit logs, role-based access, vulnerability testing and patches and will advise on material incidents. Get a clear answer on the approval needed for support staff to get into your account and how they record it.
| Control | What It Protects | Questions To Ask |
|---|---|---|
| SSL/TLS certificates | Data in transit between website and browser | Correctly configured and auto-renewed? |
| Firewalls and monitoring | Applications, networks and anything suspicious | Who is on hand after hours to respond? |
| Multi-factor authentication | Administrator, email and hosting accounts | A requirement for all privileged users? |
| Off-site backups | In the event of ransomware, system failure or deletion | How are these isolated and for how long are they kept? |
| Vulnerability testing | Software and configuration flaws | The way in which you fix and prioritise? |
| Access controls | Unwarranted third-party or internal access | Are permissions reviewed and can they be limited by role? |
Layered Defences For Your Data
You will get the most out of data encryption and access controls when they are used in concert. Encryption makes stolen data less of a threat and access controls keep systems and people from getting to it.
Passwords for your domain, hosting, payment and ecommerce accounts should be unique and strong, with multi-factor authentication. Do away with old staff logons and refrain from having the team share an administrator login; it is a convenience until a checkout is altered and you cannot put a name to it. Keep an eye on third-party providers.
Ensure Backups Can Be Restored
A backup that you can never recover is about as much use as a comforting rumour. Off-site backups must be insulated from whatever has befallen the live store. Make sure you know the recovery objectives, the retention policy and the level of encryption and isolation from administrator accounts.
Put restoration to the test, not only the making of the backup. Have those who would have to deal with it in the middle of a busy period run through a realistic scenario. Document it and address any shortfalls. When you make changes to the theme, database or platform, do it again.
In The Event Of A Breach
Your plan of action for a data breach must spell out who is to investigate and make the calls, the suppliers to be put in touch with and the support for any customers. Under the Notifiable Data Breaches scheme you may have to report an eligible breach if serious harm is likely.
- Do not obliterate the evidence while containing the incident. Engage your host or security provider, hold onto the pertinent logs and put restrictions on any accounts that have been compromised.
- Put to the test what information has been compromised and of whom, how it came about and if there is a chance of serious harm.
- Should the need arise, make the relevant parties aware of it, be they the OAIC or those affected, and put forward some practical measures for them.
- Then get to work on the root cause, change credentials as you see fit, put your decisions on record and bring the data breach response plan up to date.
One does not want to have to find out in the event of a breach that the host is without an emergency number, logs are off or the same administrator account is used for backups.
Hosting With Confidence
Compliance in ecommerce hosting is a matter of the entire set up: from the platform and plugins to the payment provider, staff and the way one communicates with customers. While the provider is of consequence, he will not be held to account for every choice made in your store.
In my experience of weighing up services, I would rather have straight talk than any amount of lofty promises. A provider worth his salt will be more of an asset if he can tell you about his subcontractors, recovery and incident procedures and where he draws the line, as opposed to one with nothing but a wall of badges to show for it.
A Provider Checklist
- Make sure you know where support access, live data and backups are to be found.
- Look into SSL/TLS, patching, firewalls, vulnerability testing and malware monitoring.
- Insist on role-based access controls and multi-factor authentication.
- Get the specifics on backup encryption, retention and frequency and how restoration is tested.
- See what the provider’s process is for breach response and notification.
- Find out how updates and extensions are handled for Magento, WooCommerce or Shopify.
- Be clear on PCI DSS obligations vis-a-vis the host, payment provider and your own business.
- Have a look at the contract with regard to service exit, portability, data deletion and so forth.
- Your privacy policy and data practices should be in line with the controls the provider offers.
Tight On Time And Budget?
An day spent on security is best put towards safeguarding administrator accounts, software and payment-card exposure, putting in place MFA and making certain you can reach your host. Such things will do more to head off immediate risk than tidying up a compliance spreadsheet.
You will be paying for responsive support and managed patching and recovery that has been put through its paces. The cost is a function of the storage, traffic and hours of support; ask for an itemised quote in AUD. In the end a bargain basement plan is no bargain when a botched update puts a store out of action in the middle of a campaign.
For the small retailer or one on the rise this gives a sound baseline. But for those with high value payment activity or regulated health data in large quantities it is insufficient; specialist legal and security counsel is called for.
Some FAQs
The sort of questions that come in once the first hosting quote is in hand. The answers below are brief, but your data flows and the particulars of the business are what count.
Applicable Privacy Laws
What of the Privacy Act 1988 and the Australian Privacy Principles? They may apply to an Australian ecommerce concern depending on what it does. Do not put all your faith in turnover figures; state and territory laws and rules for the sector could be in play as well.
Is the Privacy Act Mandatory?
Is the Privacy Act mandatory for Australian ecommerce businesses? Not in the same way for all small businesses, though the $3 million annual turnover exemption is not absolute. Your business may be subject to other laws and contractual duties even if the Act is not.
PCI DSS
What does PCI DSS cover? This is the standard for security in a payment card data environment. A hosted payment provider will narrow the scope for card data, but the website and checkout configuration must be properly secured.
Data Residency
Should ecommerce customer data be hosted in Australia? There is no rule that customer data has to be in Australia. Latency and the like may argue for it, but transparency in the contract and the strength of the controls are of greater import. Verify where everything is being hosted and backed up.
Customer Protection
How can ecommerce businesses protect customer data? Keep the data you collect to a minimum, encrypt it and limit who has access. Have a plan for a data breach and if one occurs, contain it and evaluate the harm, abiding by the Notifiable Data Breaches scheme.
Trading With Security
It is not something to put a certificate on the wall and forget. Compliance in Australia is about having sensible controls and being open with your customers. Go with an Australian host that can put its case in plain English and then oversee what is yours. As Thomas Rourke would have it: do not mistake a nice padlock for the job done, protect less and give fewer people the keys.