Recherche avancée

Sur d’autres sites (4775)

• Your Essential SOC 2 Compliance Checklist

  11 mars, par Daniel Crough — Privacy, Security

  With cloud-hosted applications becoming the norm, organisations face increasing data security and compliance challenges. SOC 2 (System and Organisation Controls 2) provides a structured framework for addressing these challenges. Established by the American Institute of Certified Public Accountants (AICPA), SOC 2 has become a critical standard for demonstrating trustworthiness to clients and partners.

  A well-structured SOC 2 compliance checklist serves as your roadmap to successful audits and effective security practices. In this post, we’ll walk through the essential steps to achieve SOC 2 compliance and explain how proper analytics practices play a crucial role in maintaining this important certification.

  Download SOC2 Checklist

  

  What is SOC 2 compliance ?

  SOC 2 compliance applies to service organisations that handle sensitive customer data. While not mandatory, this certification builds significant trust with customers and partners.

  According to the AICPA, “SOC 2 reports are intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organisation relevant to security, availability, and processing integrity of the systems the service organisation uses to process users’ data and the confidentiality and privacy of the information processed by these systems.“

  At its core, SOC 2 helps organisations protect customer data through five fundamental principles : security, availability, processing integrity, confidentiality, and privacy.

  Think of it as a seal of approval that tells customers, “We take data protection seriously, and here’s the evidence.”

  Companies undergo SOC 2 audits to evaluate their compliance with these standards. During these audits, independent auditors assess internal controls over data security, availability, processing integrity, confidentiality, and privacy.

  What is a SOC 2 compliance checklist ?

  A SOC 2 compliance checklist is a comprehensive guide that outlines all the necessary steps and controls an organisation needs to implement to achieve SOC 2 certification. It covers essential areas including :

  • Security policies and procedures
  • Access control measures
  • Risk assessment protocols
  • Incident response plans
  • Disaster recovery procedures
  • Vendor management practices
  • Data encryption standards
  • Network security controls

  SOC 2 compliance checklist benefits

  A structured SOC 2 compliance checklist offers several significant advantages :

  Preparedness

  Preparing for a SOC 2 examination involves many complex elements. A checklist provides a clear, structured path, breaking the process into manageable tasks that ensure nothing is overlooked.

  Resource optimisation

  A comprehensive checklist reduces time spent identifying requirements, minimises costly mistakes and oversights, and enables more precise budget planning for the compliance process.

  Better team alignment

  A SOC 2 checklist establishes clear responsibilities for team members and maintains consistent understanding across all departments, helping align internal processes with industry standards.

  Risk reduction

  Following a SOC 2 compliance checklist significantly reduces the risk of compliance violations. Systematically reviewing internal controls provides opportunities to catch security gaps early, mitigating the risk of data breaches and unauthorised access.

  Audit readiness

  A well-maintained checklist simplifies audit preparation, reduces stress during the audit process, and accelerates the certification timeline.

  Business growth

  A successful SOC 2 audit demonstrates your organisation’s commitment to data security, which can be decisive in winning new business, especially with enterprise clients who require this certification from their vendors.

  Challenges in implementing SOC 2

  Implementing SOC 2 presents several significant challenges :

  Time-intensive documentation

  Maintaining accurate records throughout the SOC 2 compliance process requires diligence and attention to detail. Many organisations struggle to compile comprehensive documentation of all controls, policies and procedures, leading to delays and increased costs.

  Incorrect scoping of the audit

  Misjudging the scope can result in unnecessary expenses and extended timelines. Including too many systems complicates the process and diverts resources from critical areas.

  Maintaining ongoing compliance

  After achieving initial compliance, continuous monitoring becomes essential but is often neglected. Regular internal control audits can be overwhelming, especially for smaller organisations without dedicated compliance teams.

  Resource constraints

  Many organisations lack sufficient resources to dedicate to compliance efforts. This limitation can lead to staff burnout or reliance on expensive external consultants.

  Employee resistance

  Staff members may view new security protocols as unnecessary hurdles. Employees who aren’t adequately trained on SOC 2 requirements might inadvertently compromise compliance efforts through improper data handling.

  Analytics and SOC 2 compliance : A critical relationship

  One often overlooked aspect of SOC 2 compliance is the handling of analytics data. User behaviour data collection directly impacts multiple Trust Service Criteria, particularly privacy and confidentiality.

  Why analytics matters for SOC 2

  Standard analytics platforms often collect significant amounts of personal data, creating potential compliance risks :

  1. Privacy concerns : Many analytics tools collect personal information without proper consent mechanisms
  2. Data ownership issues : When analytics data is processed on third-party servers, maintaining control becomes challenging
  3. Confidentiality risks : Analytics data might be shared with advertising networks or other third parties
  4. Processing integrity questions : When data is transformed or aggregated by third parties, verification becomes difficult

  How Matomo supports SOC 2 compliance

  

  Matomo’s privacy-first analytics approach directly addresses these concerns :

  1. Complete data ownership : With Matomo, all analytics data remains under your control, either on your own servers or in a dedicated cloud instance
  2. Consent management : Built-in tools for managing user consent align with privacy requirements
  3. Data minimisation : Configurable anonymisation features help reduce collection of sensitive personal data
  4. Transparency : Clear documentation of data flows supports audit requirements
  5. Configurable data retention : Set automated data deletion schedules to comply with your policies

  By implementing Matomo as part of your SOC 2 compliance strategy, you address key requirements while maintaining the valuable insights your organisation needs for growth.

  Conclusion

  A SOC 2 compliance checklist helps organisations meet critical security and privacy standards. By taking a methodical approach to compliance and implementing privacy-respecting analytics, you can build trust with customers while protecting sensitive data.

  Start your 21-day free trial — no credit card needed.

• The Guide to an Ethical Web : With Big Data Comes Big Responsibility

  13 mars, par Alex Carmona

  Roughly two-thirds of Earth’s 8 billion people use the internet for communication, education, entertainment, business and more. We are connected globally in ways previous generations could’ve never dreamed of. It’s been a wild ride, and we’re just starting.

  Many users have learned that experiences online can be a mix of good and bad. Sometimes, the bad can feel like it outweighs the good, particularly when large tech companies use our data shadily, cut corners on accessibility or act in any other way that devalues the human being behind the screen.

  As fellow internet citizens, what responsibility do we have to create a more ethical web for our customers ?

  In this article, we’ll look at ethical principles online and how to act (and not act) to build trust, reach customers regardless of ability, safeguard privacy and stay compliant while improving business outcomes.

  

  What is an “ethical web” ?

  When we talk about the ethical web, we’re talking about the use of the internet in an ethical way. Among other values, it involves transparency, consent and restraint. It applies the Golden Rule to the internet : Treat others (and their data and user experience) how you’d want yourself (and yours) to be treated. 

  With limited oversight, the internet has evolved in ways that often prioritise profit over user rights. While selling data or pushing cookies might seem logical in this context, they can undermine trust and reputation. And the tide is slowly but surely shifting as consumers and legislators push back.

  Consumers no longer want to buy from companies that will use their data in ways they don’t agree to. In 2022, 75% of UK and US consumers surveyed said they were uncomfortable purchasing from businesses with weak data ethics.

  Legislators worldwide have been taking part in this effort for nearly a decade, with laws like GDPR in the EU and LGPD in Brazil, as well as the various state laws in the US, like California’s CCPA and Virginia’s VCDPA. 

  Even tech giants are no longer above the law, like Meta, which was fined over a billion Euros for GDPR violations in 2023.

  

  These changes may make the internet feel less business-friendly at first glance, but ethical choices ultimately build a stronger digital ecosystem for both companies and consumers. 

  Likewise, all internet users alike can make this happen by shunning short-term profit and convenience for healthier, long-term choices and behaviour.

  As we dig into what it takes to build an ethical web, remember that no company or individual is free from mistakes in these areas nor is it an overnight fix. Progress is made one click at a time.

  Ethical SEO : Optimising your content and your ethics

  Content creation and search engine optimisation (SEO) require so much work that it’s hard to fault creators for not always abiding by search engine guidelines and seeking shortcuts – especially when there’s a sea of LinkedIn posts about how copying/pasting ChatGPT responses helped someone rank #1 for several keywords in one week.

  However, users turn to Google and other search engines for something of substance that will guide or entertain them.

  Content meets customer needs and is more likely to lead to sales when it’s well-written, original and optimised just enough to make it easier to find on the first page of results. This doesn’t happen when content teams dilute quality and waste a reader or viewer’s time on posts that will only yield a higher bounce rate.

  Some SEO pros do find success by building backlinks through private blog networks or crafting a million unedited posts with generative AI, but it’s short-lived. Google and other search engines always catch up, and their content plummets or gets penalised and delisted with every new update.

  Content teams can still rank at the top while sticking to ethical SEO principles. Here’s a sample list of dos and don’ts to get started :

  • Do put content quality above all else. Make content that serves the audience, not just a brand or partner ad network.
  • Do apply the E-E-A-T framework. Search engines value content written by authors who bring expertise, experience, authority and trust (E-E-A-T).
  • Don’t keyword stuff. This might have worked in the early days of SEO, but it hurts readability and now harms article performance.
  • Do use alt text as intended. While it can still help SEO, alt text should prioritise accessibility for users with screen readers.

  • Don’t steal content. Whether it’s violating copyright, copying/pasting other people’s content or simply paraphrasing without citation, companies should never steal content.
  • Don’t steal ideas. It’s okay to join in on a current conversation or trends in an industry, but content creators should be sure they have something valuable to add.
  • Do use AI tools as partners, not creators. AI can be an incredible aid in crafting content, but it should never be posted without a human’s touch.

  When we follow ethical SEO guidelines and get more clients with our content, how do we best handle their data ?

  Ethical data governance : Important principles and how to avoid data misuse

  Data governance comprises every aspect of how a company manages data, including storage, security, privacy, lifecycle management, setting policies and maintaining compliance with laws like GDPR and HIPAA.

  Applying data ethics to governance is doing it all in a transparent, restrained way that acknowledges an individual’s right to ownership over their data. 

  For organisations, this translates to getting consent to collect data and clearly spelling out how it will be stored and used — and sticking to it.

  If a user’s birth date is needed for legal reasons, it cannot be sold to a third party or later used for something else without explicit permission. Reusing data in ways that stray from its original purpose is a form of commingling, one of the data misuses that is easy for even well-intentioned teams to do accidentally.

  Ethical data governance also includes the vigilant safeguarding of users’ data and minimising potential privacy issues.

  Failing to implement and adhere to strong security measures leads to situations like the National Public Data (NPD) breach, where cyber criminals expose the addresses, phone numbers and social security numbers of hundreds of millions of people. This was due in large part to a weakness in storing login credentials and a lack of password policy enforcement.

  No one at NPD wanted this to happen, but security likely took a backseat to other business concerns, leading to the company’s filing for bankruptcy.

  More importantly, as a data broker that aggregates information from other sources, the people affected likely had no clue this organisation had been buying and selling their data. The companies originally entrusted with their information helped provide the leaked data, showing a lack of care for privacy.

  Situations like this reinforce the need for strict data protection laws and for companies to refine their data governance approach. 

  Businesses can improve their data governance posturing with managers and other higher-ups setting the right tone at the top. If leadership takes a firm and disciplined approach by setting and adhering to strong policies, the rest of the team will follow and minimise the chances of data misuse and security incidents.

  One way to start is by using tools that make the principles of data ethics easier to follow.

  Ethical web analytics : Drawing insights while respecting privacy

  Web analytics tools are designed to gather data about users and what they do while visiting a site.
  The most popular tool worldwide is Google Analytics (GA). Its brand name and feature set carry a lot of weight, but many former users have switched to alternatives due to dissatisfaction with the changes made in GA4 and reservations about the way Google handles data.

  

  Google is another tech giant that has been slapped with massive GDPR fines for issues over its data processing practices. It has run so afoul of compliance that it was banned in France and Austria for a while. Additionally, in the US Department of Justice’s ongoing antitrust lawsuit against Google, the company’s data tracking has been targeted for both how it affects users and potential rivals.

  Unlike GA, ethical web analytics tools allow websites to get the data they need while respecting user privacy.

  Matomo offers privacy protections like :

  • Providing data anonymisation and IP anonymisation
  • Allowing users the ability to not process personally identifiable information (PII)
  • Disabling the ability to track users across websites by default to make compliance easier
  • Giving users full control over their customer data without the risk of it getting into the hands of third parties
  • Much more

  We’re also fully transparent about how we handle your data on the web and in the Matomo Cloud and in how we build Matomo as an open-source tool. Our openness allows you to be more open with your customers and how you ethically use their data.

  There are other GDPR-compliant tools on the market, but some of them, like Adobe Analytics, require more setup from users for compliance, don’t grant full control over data and don’t offer on-premise options or consent-free tracking.

  Beyond tracking, there are other ways to make a user’s experience more enjoyable and ethical.

  Ethical user experience : User-friendliness, not user-hostility

  When designing a website or application, creating a positive user experience (UX) always comes first. 

  The UI should be simple to navigate, data and privacy policy information should be easy to find and customers should feel welcomed. They must never be tricked into consenting or installing. 

  When businesses resort to user-hostile tactics, the UX becomes a battle between the user and them. What may seem like a clever tactic to increase sign-ups can alienate potential customers and ruin a brand’s image. 

  Here are some best practices for creating a more ethical UX :

  Avoid dark patterns

  Dark patterns are UI designs and strategies that mislead users into paying for, agreeing to or doing something they don’t actually want. These designs are unethical because they’re manipulative and remove transparency and consent from the interaction. 

  In some cases, they’re illegal and can bring lawsuits. 

  In 2023, Italy’s Data Protection Authority (DPA) fined a digital marketing company €300,000 for alleged GDPR violations. They employed dark patterns by asking customers to accept cookies again after rejecting them and placing the option to reject cookies outside the cookie banner. 

  Despite their legality and 56% of surveyed customers losing trust in platforms that employ dark patterns, a review by the Organisation for Economic Co-operation and Development (OECD) found that 76% of the websites examined contained at least one dark pattern.

  

  If a company is worried that they may be relying on dark patterns, here are some examples of what to avoid :

  • Pre-ticking boxes to have users agree to third-party cookies, sign up for a newsletter, etc.
  • Complicated cookie banners without a one-click way to reject all unnecessary cookies
  • Hiding important text with text colour, under drop-down menus or requiring hovering over something with a mouse 
  • “Confirm shaming” users with emotionally manipulative language to delay subscription cancellations or opt out of tracking 

  Improve trust centres

  Trust centres are the sections of a website that outline how a company approaches topics like data governance, user privacy and security. 

  They should be easy to find and understand. If a user has a question about a company’s data policy, it should be one click away with language that doesn’t require a law degree to comprehend.

  Additionally, trust centres must cover all relevant details, including where data is stored and who does the subprocessing. This is an area where even some of the best-intentioned companies may miss the mark, but it’s also an easy fix and a great place to start creating a more ethical web.

  Embrace inclusivity

  People want to feel welcomed to the party — and deserve to be — regardless of their race, ethnicity, religion, gender identity, orientation or ability. 

  Inclusivity is great for customers and companies alike. 

  A study by the Unstereotype Alliance found that progressive marketing drove up short- and long-term sales, customer loyalty and purchase consideration. A Kantar study reported that 75% of surveyed customers around the world consider a company’s diversity and inclusivity when making a purchasing decision.

  An easy place to start embracing inclusivity is with a website’s blog images. The people in photos and cartoons should reflect a variety of different backgrounds.

  Another area to improve inclusivity is by making your site or app more accessible.

  Accessibility ethics : An internet for everyone

  Accessibility is designing your product in a way that everyone can enjoy or take part in, regardless of ability. Digital accessibility is applying this design to the web and applications by making accommodations like adding descriptive alt text to images for users with visual impairments.

  Just because someone has a hearing, vision, speech, mobility, neurological or other impairment doesn’t mean they have any less of a right to shop online, read silly listicles or get into arguments with strangers in the comment section.

  Beyond being the right thing to do, the Fable team shows there’s a strong business case for accessibility. People with disabilities have money to spend, and the accommodations businesses make for them often benefit people without disabilities, too – as anyone who streams with subtitles can attest.

  Despite being a win-win for greater inclusivity and business, much of the web is still inaccessible. WebAIM, a leader in web accessibility, studied a million web pages and found an average of over 55 accessibility errors per page.

  We must all play a more active role in improving the experience of our users with disabilities, and we can start with accessibility auditing and testing.

  An accessibility audit is an evaluation of how usable a site is for people with disabilities. It may be done in-house by an expert on a company’s team or, for better results, a third-party consultant who can give a fully objective audit.

  Auditing might consist of running an automated tool or manually checking your site, PDFs, emails and other materials for compliance with the Web Content Accessibility Guidelines list.

  Accessibility testing is narrower than auditing. It checks how accessibility or its absence looks in action. It can be done after a site, app, email or product is released, but it ideally starts in the development process.

  Testing should be done manually and with automated tools. Manual checks put developers in the position of their users, allowing them to get a better idea of what users are dealing with firsthand. Automated tools can save time and money, but there should always be manual testing in the process.

  Auditing gives teams an idea of where to start with improving accessibility, and testing helps make sure accommodations work as intended.

  Conclusion

  At Matomo, we strive to make the ethical web a reality, starting with web analytics.

  For our users, it means full compliance with stringent policies like GDPR and providing 100% accurate data. For their customers, it’s collecting only the data required to do the job and enabling cookieless configurations to get rid of annoying banners. 

  For both parties, it’s knowing that respect for privacy is one of our foundational values, whether it’s the ability to look under Matomo’s hood and read our open-source code, the option to store data on-premise to minimise the chances of it falling into the wrong hands or one of the other ways that we protect privacy.

  If you weren’t 100% ethical before, it’s never too late to change. You can even bring your Google Analytics data with you.

  Join us in our mission to improve the web. We can’t do it alone ! 

  Try Matomo free for 21 days

  no credit card required

• avutil/tests/aes_ctr : test more than a single block worth of data

  1er avril, par James Almer

  avutil/tests/aes_ctr : test more than a single block worth of data
  This should exercise the implementation more thoroughly after an upcoming
  
  change.
  Signed-off-by : James Almer <jamrial@gmail.com>
  

  • [DH] libavutil/tests/aes_ctr.c