Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Here are the main areas of the site that could become a security concern:

  1. The site works as a general ledger system against the company and its users.

  2. The ledger system is to keep track of small deposits ($0.10 up to $10.00). Some users have amassed decent sized accounts (upwards of $100's of dollars) but the vast majority have little or nothing in their accounts.

  3. The site allows users to withdraw money from their account (with the site) to their Paypal account.

    • They can also send money into their student card (if they happen to be a student).

Now, as far as I know, PCI only covers credit & debit cards, not student cards.

What security laws would need to be considered in this situation?

share|improve this question
    
Why implement bad security. Implement the best security you can. The best security would solve all your problems. If your website gets hacked, then you will be held resonsible, and thus you could lose customers or worst be sued by your customers. –  Ramhound Oct 15 '12 at 17:45
add comment

1 Answer

up vote 3 down vote accepted

There are no specific laws or regulations that apply to this application. That being said, if a vulnerability in your software allows an attacker to take money from another user, or leak personal information then you can be sued for negligence. In the U.S. you cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement.

share|improve this answer
    
Does "You cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement" apply in the states? I've seen several T.o.S agreements that have a portion that state otherwise. –  Digital Fire Oct 13 '12 at 5:52
    
@Digital Fire the US is the only place where I know this applies. I am not sure about international law. –  Rook Oct 13 '12 at 17:34
    
@Rook What exactly constitutes as "personal information"? We track things like first & last name, as well as email. Are those considered "personal information"? –  farleyknight Oct 15 '12 at 15:41
    
@farleyknight It depends on how good the prosecuting attorney is. Personally, I'd be wary of leaking someone's favorite color. –  Rook Oct 15 '12 at 17:35
    
@DigitalFire - What you remember is a clause people cannot join a "class action" suit. But you cannot give up your right to sue. –  Ramhound Oct 15 '12 at 17:46
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.