Integrated Security By Design
We recently introduced the concept of security as a competitive advantage. Organizations are seeking to differentiate themselves based on the way they treat customer data – and the motivation is clear: 78 percent of consumers only want to buy from companies they trust to protect their personal data. For technology companies that have access to customer data, we see a constant balance being struck between building better, more personalized experiences and respecting the rights and regulations of customer privacy. The stakes are increasing with high profile hacks and regulations such as GDPR and California’s nearly as aggressive response. As a result, many technology companies are seeking ways to integrate security by design into the core of their platforms.
“In order to build trust in these digital products and services, companies must integrate security throughout their development processes, rather than bolting it on at the end.” – Source
The Old Way
This has been a huge challenge for companies that capture and visualize a customer’s experience on web and native apps. It’s hard to understand why a customer did what they did if you don’t know who they were. But being able to re-identify a customer has legal implications and has to be done carefully. As a result, most companies in the Customer Experience space (ranging from Voice of Customer solutions to session replay) have made the decision to simply not capture any personally identifiable information (PII) and take no responsibility if anything is inadvertently captured. We are going to refer to this as “The Old Way.” In this method you had two options with customer data – blocked or unencrypted:
This works fine if you are looking to understand aggregate trends in the data but has three key limitations:
1. Use-cases covered: Anonymous data excludes use-cases such as customer service and fraud. If a customer calls or writes in saying that X Y Z happened, it would be difficult or impossible to associate that human with their online session.
2. Cross-Device Tracking: A single session often doesn’t tell the full story – following a single user across session and even device by knowing who they are when they authenticate can yield a much more complete story.
3. Reliance on humans: It’s easy to say you are simply not capturing PII – but the only way to ensure and enforce that is to have a human scan every single page, leaving room for error. And if you miss something, it will come through as plain text available to anyone in the platform.
The New Way
At Quantum Metric, we viewed this challenge as something we needed to solve in order to deliver on the use-cases we saw as critical for our customers. We started with security as a foundation to how we would build our entire platform – and then shaped our capabilities and work flows around this priority. The solution we came to was simple yet novel. Rather than just giving companies the option of either blocking or capturing un-encrypted data – we added a third option. At the point at which data is captured, we encrypt everything with a 2048 bit military grade private/public key encryption. We then allow our customer admins to generate the private key so that they would have full control over who could access their data by sharing this key – only coworkers who need it and of course no Quantum Metric employee would have access. Here is how the options look in this model:
So now, you can block things that are highly sensitive and have no real business value in capturing (i.e. SSN, Credit Card #’s) and encrypt the rest so that only the people with the right level of authority can access.
What It Takes to Be the Only GDPR-Compliant SaaS Solution
With the technological framework in place, we next thought about the process by which customers could be re-identified – this was critical to GDPR compliance. We created a workflow that could allow anyone with the private key installed to re-identify a customer with a notification process and audit trail in line with GDPR rules.
We also knew there would be customer service reps (CSR) who would need access to specific users without being granted access to the entire user data set. For that we created the CSR role in our platform and gave them the ability to search for specific users based on EXACT MATCH only. In this way, if a CSR already has a customer’s ID or email address, they can search for it specifically without being able to see anyone else’s information.
Security as an Enabler
The number of technologies collecting user data is increasing as fast or faster than the ways by which this data can be used – hopefully to deliver better, more personalized experiences to customers. For this trend to continue, all technology verticals need to embrace the “security by design” philosophy. If not, we risk lawsuit, lack of trust, and the slowing of innovation.
We are proud to be leaders in this space and always love the opportunity to talk more about security by design as an enabler rather than a hindrance. If you want to talk more, drop us a line.
Did you miss our first post in the Security as a Differentiator series? Read Part 1 here.