5

Here are the main areas of the site that could become a security concern:

  1. The site works as a general ledger system against the company and its users.

  2. The ledger system is to keep track of small deposits ($0.10 up to $10.00). Some users have amassed decent sized accounts (upwards of $100's of dollars) but the vast majority have little or nothing in their accounts.

  3. The site allows users to withdraw money from their account (with the site) to their Paypal account.

    • They can also send money into their student card (if they happen to be a student).

Now, as far as I know, PCI only covers credit & debit cards, not student cards.

What security laws would need to be considered in this situation?

Improve this question
1
  • Why implement bad security. Implement the best security you can. The best security would solve all your problems. If your website gets hacked, then you will be held resonsible, and thus you could lose customers or worst be sued by your customers.
    – Ramhound
    Oct 15, 2012 at 17:45

1 Answer 1

Reset to default
3

There are no specific laws or regulations that apply to this application. That being said, if a vulnerability in your software allows an attacker to take money from another user, or leak personal information then you can be sued for negligence. In the U.S. you cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement.

Improve this answer
7
  • Does "You cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement" apply in the states? I've seen several T.o.S agreements that have a portion that state otherwise.
    – Digital fire
    Oct 13, 2012 at 5:52
  • @Digital Fire the US is the only place where I know this applies. I am not sure about international law.
    – rook
    Oct 13, 2012 at 17:34
  • @Rook What exactly constitutes as "personal information"? We track things like first & last name, as well as email. Are those considered "personal information"?
    – farleyknight
    Oct 15, 2012 at 15:41
  • @farleyknight It depends on how good the prosecuting attorney is. Personally, I'd be wary of leaking someone's favorite color.
    – rook
    Oct 15, 2012 at 17:35
  • @DigitalFire - What you remember is a clause people cannot join a "class action" suit. But you cannot give up your right to sue.
    – Ramhound
    Oct 15, 2012 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.