We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we at least do our best effort.
By choosing one of the big cloud platform solutions (Azure, AWS, Google) you at least know they do their best to keep hackers away from your web/database servers.
So, let's pick e-commerce for example: A lot of customers, a lot of personal data stored in one database and a lot of employees that want to "work" with the data.
Let's say Azure/AWS/Google does their job good at security and the developers do their job good at security. That means it actually comes down to your employees working with the data of all the customers.
You know, those employees who use the same password everywhere, ending with their birthday and a ! because some password fields require a special character. Those employees that would click on any link they receive in their inbox.
Most, if not all, web applications allow to export data. "I want to analyse last year's sales", "I want to analyse stock inventory". All valid reasons for employees to get your data in Excel and play around with the data.
Now what I am wondering, how do small to large businesses deal with security?
In theory, a employee could export all customer data, have it stored on their personal computer, the personal computer gets stolen and 5 days later an awesome database pops up online containing all your users information. Or these days it is not that uncommon for small and big businesses being hacked, so one of the employees could be the target where they are able to hack and get the data from their personal computer.
Do you:
- Limit the employee in how much data it can export?
- Somehow allow or deny access to exporting certain fields?
- Enforce to always upload to a cloud storage like Microsoft OneDrive and educate the user not downloading it?
- Use Active Directory while employees use their personal computers?
- No export at all and provide dashboard graphs on-request?
What else?