Most people have personal information on many sites such as Amazon or smaller sites. When we type create an account and add details like our address and the place where we work, it is never said how well this information will be stored and secured. Then how do we know we can trust a site to be secure ? What if everything was stored as plain text or what if they were to sell this information ? Is there a way to verify this without being a security expert ? Thanks.
Any time you provide information to any service provider there is an inherent level of trust involved. The best way to get the information you're looking for is by asking for it, but you have to hope and trust that they're telling you the truth and that security is actively addressed and measures are maintained.
- Ask the service provider for information on their security practices, data storage and retention policies, data centre locations etc. They can appropriately answer these questions without sacrificing operational security and refusal to answer these questions should leave you wary.
- Depending on the information they maintain and their jurisdiction there are frameworks and laws that need to be adhered to so ask about their compliance. These will vary but some notable ones are PCI DSS for those who handle credit card data and HIPAA (US) for health information and FIPPA (Canada).
- You can inquire as to how passwords are protected if you're so inclined. We'd like to think that everyone hashes their password with a strong algorithm but even large companies have hashed with no salt or weak algorithms.
- Inquire about their data sharing policies - who are they planning on sharing your data with? Ask them if they've done their due diligence in vetting their partners security. Many cyber security policies require the policy holder to vet and provide information to the insurer in regards to their partners security practices.
Now with that said it's not uncommon for organizations to think that they're secure but to completely overlook that dev box they stood up for testing a year ago that contained live data that wasn't included in the scope of security. Again we go back to that concept of trust but there is no real effective way to mitigate the risk of your personal information being compromised. Reduce your potential attack vector by being selective in who you provide your information to and you'll reduce the likelihood that your info will end up in the hands of people you don't want it to.
it is never said how well this information will be stored and secured
Ensure that the company that you trust has been through independent audits and has been certified to meet compliance standards. Depending upon the location, regulatory bodies have been known to act against deceptive practices.
As an individual you have very little power for individual verification for most websites. The Australian Government has a simple 8 point list of what to look for before you trust an entity.