A majority of organisations are creating unnecessary risks by using actual customer data for the development and testing of applications, according to a survey by Compuware and the Ponemon Institute.
The report – entitled "Test data insecurity: the unseen crisis" – found that 58% of UK companies surveyed use actual customer data instead of disguised data to test applications during the development process.
Of those companies using actual customer data, 79% use full customer files and 68% use customer lists.
Examples of the live data often used include employee records, customer account numbers, credit card numbers, Social Security numbers and other credit, debit or payment information.
The authors of the study warned that while organisations may think that test data is immune from privacy threats because testing occurs in a non-production environment, these environments are less secure than production environments.
They said testing data could be exposed to a variety of unauthorised sources including in-house testing staff, consultants, partners and offshore personnel.
But despite these risks the study found that 35% of respondents outsourced their application testing, and 38% shared live data with the outsourced organisation.
“For many organisations, large customer data files represent an easy, cheap source of data to use when testing applications, but this process introduces a huge element of risk to the challenge of maintaining the integrity of sensitive information, particularly when third parties and offshore resources are involved,” said Dr Larry Ponemon, chairman and founder of Ponemon Institute.
“This study points to a need for greater awareness and accountability over how sensitive data is used within organisations.
“Common practices as they relate to all uses of live data must be evaluated to assess risk, and safeguards implemented to ensure data security,” he added.
The report also found that half of the companies using actual customer data for testing purposes do not take steps to protect that information. Other significant findings included:
• 43% of respondents have no way of knowing if the data used in testing had been compromised.
•17% of respondents reported they do not protect live data used in software development.
• 36% of respondents were unsure if live data their organization used for testing or development had been lost or stolen.
• 11% of respondents said they did not know who was responsible for securing test data, 43% believed the development organisation was responsible and 14% said the business units sponsoring the development was responsible, suggesting no clear ownership for sensitive test data.
The study was conducted between July 2007 and August 2007, with the results derived from the responses of 897 IT professionals with an average of ten years' experience.