Heads up! To view this whole video, sign in with your Courses account or enroll in your free 7-day trial. Sign In Enroll

Introduction to Data Security

Preview

Start a free Courses trial
to watch this video

Sign up for Treehouse

Services

3:44 with Kenneth Love

There are many services you can use to handle sensitive data for you.

Again, this list won't be exhaustive; new services and techniques come up every day. Here, though, are a few articles, services, and tools you can use to offset some of your own work:

Related Discussions

Have questions about this video? Start a discussion with the community and Treehouse staff.

Sign up

    Related Discussions

    Have questions about this video? Start a discussion with the community and Treehouse staff.

    Sign up

    One of the biggest challenges of data today is just how much of it is out there. 0:00
    Data breaches are unfortunately a given. 0:04
    Your data as a user or consumer is going to get out there. 0:06
    Your data as a business is highly sought after. 0:09
    We give out a lot of data. 0:12
    Phone numbers, government ID numbers, dates of birth, 0:13
    not to mention payment info like credit card and bank account numbers. 0:16
    As a service provider, you can help to minimize the damage done by data breaches, 0:19
    by just not collecting and storing data. 0:22
    Let's start with the easiest part, don't collect data that you don't need. 0:25
    It's really tempting to ask users for anything you think you might ever need. 0:28
    For example, your service might in the future, 0:32
    implement automatic phone calls for suspicious account behavior. 0:34
    That's a great feature. 0:37
    But you don't have it yet, and I certainly haven't opted into it yet, so 0:38
    don't ask me for my phone number. 0:41
    The less data you store, the less can be lost in a successful hacking attempt. 0:43
    Okay, but that's obvious, right? 0:47
    What about things you have to have the data? 0:49
    Like user accounts, you can't really get around storing passwords, right? 0:51
    Actually you can. There are few common modern ways of 0:55
    avoiding storing user passwords that could get leaked. 0:56
    The first is social media accounts. 0:59
    Instead of requiring your users to create a new account on your service and 1:02
    you having to store their password and other account details, 1:05
    you let them sign up with their Facebook, Twitter, GitHub or whatever else account. 1:08
    You'll store a token that the service provides you instead of a password. 1:12
    You can usually request other information from the third party service too 1:15
    like email addresses and legal names. 1:18
    Sometimes you can even ask for that on demand. 1:20
    This technique is known as OAuth, 1:23
    and it's quickly becoming a common feature throughout the industry. 1:24
    Check the teacher's notes on for 1:27
    links to treehouse content on how to take advantage of OAuth for your own projects. 1:28
    Another alternative is the OpenID technology. 1:32
    This bit of tech allows people to use their logins from other systems, 1:35
    much like with OAuth. 1:38
    OpenID relies, as you should have come to expect by now, on a shared secret between 1:40
    the requesting system, your site or service, and the authentication provider. 1:44
    It's not quite as popular as OAuth, but it's a secure, reliable system. 1:48
    Isn't that data still vulnerable to a breach though? 1:52
    I mean if Facebook gets hacked that data is still gonna be out there right? 1:54
    Sure. 1:58
    But companies like Facebook have massive teams and 1:58
    massive bank accounts aimed squarely at preventing these breaches. 2:01
    While they won't always have more protection and security than you do, 2:04
    it's often a good assumption. 2:06
    There's a theory in the industry too. 2:08
    That one of the reasons users stick with bad or 2:09
    repeated passwords is because we require them to create so many of them. 2:11
    It's possible that users will use better passwords if they have to 2:15
    have a few of them. 2:18
    Services like OAuth and OpenID might lead to this. 2:19
    The next option is a newer type of service that's been appearing the last few years. 2:23
    Much like using social media sites for login, services like Octa and 2:27
    Certify let you register and 2:30
    authenticate users without having to store their details on your own servers. 2:31
    Again, you're relying on a much more focused company for 2:35
    the security instead of having to divide up your own attention. 2:38
    Lastly, what about payment details? 2:41
    I know in the early days of buying things on the Internet it wasn't 2:43
    uncommon to find a service provider or e-commerce shop that would store their 2:46
    customers payment details in their own database. 2:49
    Often these were stored in plain, unencrypted text too. 2:51
    The headaches caused by any breach in those databases. 2:54
    Luckily, now though, services like Stripe, PayPal and Authorize.net all exist and 2:57
    allow you to safely and securely charge people money for your products and 3:01
    services. 3:05
    Without having to store the the payment details yourself. 3:05
    In fact, if you did want to store those major credit card details yourself, 3:09
    you must implement PCIDSS, or the Payment Card Industry Data Security Standard. 3:12
    PCI represents American Express, Discover, JCB, MasterCard and Visa. 3:18
    There aren't many cards out there that aren't issued by one of those. 3:23
    Depending on the size of your operation, you may or 3:26
    may not have to have your compliance verified. 3:28
    I put some information in the teacher's notes about all of these services. 3:31
    Be sure to read through them if they apply to your projects. 3:33
    And look for places where you can avoid storing user data. 3:36
    Now, let's take a look at a feature that's quickly becoming a requirement for 3:38
    messaging software, end-to-end encryption. 3:41

    You need to sign up for Treehouse in order to download course files.

    Sign up

      You need to sign up for Treehouse in order to set up Workspace

      Sign up