Insights

When you hire an electrician, plumber or builder, there are licences, standards and regulatory frameworks designed to give you some confidence that the person doing the work is qualified to do it. Software is different. In Australia, there is no universal licence required to call yourself a software developer, build a business system or sell technology to an organisation. That doesn’t mean technology is unregulated. Organisations still have obligations under privacy, data protection and industry-specific legislation, and those obligations can be significant when a system holds personal or sensitive information. But there is an important gap. There is no single regulator standing over every software provider checking that the systems they build are secure, supported and following current development practices. That means organisations need to ask questions themselves. A system can work perfectly and still be insecure One of the most dangerous assumptions organisations can make is that if a system is working, it must be safe. Users can log in. Records can be entered. Reports can be generated. Nothing appears to be broken. Meanwhile, the technology underneath it may be years out of date. In a recent review undertaken by HutSix, significant security issues became apparent during ordinary use of an existing business system. It wasn’t a penetration test or formal security audit, and no attempts were made to exploit the system. The problems were simply visible. They included technology that had been out of support for years, sensitive information being accessible more broadly than necessary, insufficient access logging, two-factor authentication that was available but not enforced, publicly exposed technical information and outdated security practices. The important point isn’t the particular system. It’s that an organisation can rely on software every day without necessarily knowing what is happening underneath it. Old software isn’t just old Technology ages differently from most physical assets. A 20-year-old filing cabinet can still securely hold paperwork if the lock works. A 20-year-old software platform is a different proposition. Software vendors regularly release security patches when vulnerabilities are discovered. Eventually, products reach the end of their supported life and those patches stop. The software doesn’t suddenly stop working. That’s part of the problem. It can keep operating perfectly normally while newly discovered vulnerabilities remain permanently unpatched. The Australian Signals Directorate’s current software development guidance recommends practices including separating development, testing, staging and production environments and applying appropriate controls throughout the software lifecycle. Modern software security isn’t something added at the end of development. It needs to be part of how systems are designed, maintained and operated. Your organisation may still carry the responsibility If your system holds personal information, outsourcing the software doesn’t necessarily outsource your obligations. Australian Privacy Principle 11 requires organisations covered by the Privacy Act to take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Those reasonable steps specifically include technical and organisational measures. The more sensitive the information, the greater those reasonable precautions may need to be. That is particularly important for organisations holding information such as health records, disability information, financial details, identity documents or information relating to vulnerable people. Asking your software provider whether a system is secure is a start. It shouldn’t be the end of the conversation. There are simple checks you can do yourself You don’t need to be a cyber security specialist to start asking better questions. There are free public tools that can provide a useful first look at aspects of your website or online system. SSL Labs Qualys SSL Labs provides a free SSL Server Test that analyses the SSL and TLS configuration of a public-facing server. SSL and TLS are responsible for encrypting information travelling between your browser and a website. The test can identify issues with areas such as certificates, supported protocols and server encryption configuration and provide an overall grade.  You can enter the domain of your public website or system here: https://www.ssllabs.com/ssltest/ SSL Labs describes the assessment as non-intrusive and specifically notes that it examines the SSL configuration of public servers rather than attempting to exploit them. Security Headers Modern websites can send security instructions, known as HTTP response headers, to a user’s browser. These can help reduce the risk of attacks such as malicious scripts, clickjacking and other browser-based threats. Security Headers checks which of these protections your website is sending and provides a grade from A+ through to F. You can test a site here: https://securityheaders.com/ The tool isn’t a complete security audit, and a good score doesn’t guarantee that an application is secure. But a poor result can highlight areas worth asking your provider about. Neither test tells you everything This part is important. An A+ from an online scanner does not mean your system is secure. Tools like SSL Labs and Security Headers only examine particular publicly observable aspects of an application. They can’t tell you whether: staff have access to information they shouldn’t passwords are being stored securely sensitive information is unnecessarily visible exported data is properly controlled administrators have excessive permissions access to records is being logged backups are secure old or unsupported components exist deeper within the application two-factor authentication is properly enforced developers are following secure development practices. Those questions require deeper investigation. But simple external tests can be a useful starting point, particularly if you’ve never independently checked the system your organisation relies on. Questions worth asking your technology provider If your software holds important organisational or personal information, ask your provider: What technology is the system built on, and is every major component still supported? How often are security updates and patches applied? Is two-factor authentication available and enforced? Who can access sensitive information? Can permissions be restricted according to a person’s role? Is access to sensitive records logged? Can you identify who viewed, changed or exported information? How is data encrypted in transit and at rest? When was the system last independently security tested? What happens when a vulnerability is discovered? What is the process for keeping the platform current as technology changes? A reputable provider should be comfortable answering those questions. If they can’t, that is useful information too. Security is part of maintaining software Software isn’t something you build once and leave untouched for the next 20 years. Browsers change. Operating systems change. Security standards evolve. New vulnerabilities are discovered. Frameworks and programming languages reach end of life. Maintaining a system means more than fixing something when a user reports a bug.It means monitoring the technology underneath it, applying updates, reviewing permissions, improving security controls and planning migrations before unsupported technology becomes a business risk. The OAIC’s guidance reflects this broader view of information security, describing reasonable protection as a combination of governance, internal processes, ICT security, access controls, third-party management and other technical and organisational measures. Trust, but verify Most organisations aren’t software companies. They shouldn’t be expected to understand every framework, server configuration or security header their systems use. But they should be able to expect transparency from the people responsible for their technology. Ask questions. Run the simple checks. Find out how old your systems are. Find out when they were last independently reviewed. And if your organisation holds sensitive information, don’t wait for a data breach before discovering whether the technology protecting it is still fit for purpose. Good technology isn’t just about whether the software works. It’s about whether you can trust what is happening underneath it. Not sure how secure your current systems are? Talk to HutSix about a security review and find out what’s happening beneath the surface.