Privacy Advisor

Compuware and Ponemon Survey

Privacy News

February 1, 2008

Survey Reveals Use of Consumer Data for Application Testing Puts Information at Risk

A survey conducted by Compuware Corporation and the Ponemon Institute showed an overwhelming majority of organizations surveyed risk compromising critical information by using actual customer data for the development and testing of applications.

The Insecurity of Test Data: The Unseen Crisis report found that 62 percent of companies surveyed use actual customer data instead of disguised data to test applications during the development process. Of those companies using actual customer data, 89 percent use customer files and 74 percent use customer lists. Examples of the live data often used include employee records, vendor records, customer account numbers, credit card numbers, Social Security numbers and other credit, debit or payment information.

According to a news release describing the survey's findings, while organizations may think that test data is immune from privacy threats because testing occurs in a non-production environment, these environments are less secure than production environments. Testing data may be exposed to a variety of unauthorized sources including in-house testing staff, consultants, partners and offshore personnel. In fact, 52 percent of respondents outsourced their application testing, and 49 percent of those respondents shared live data with the outsourced organization.

The survey found that half of the companies using actual customer data for testing purposes do not take steps to
protect that information. Other significant findings included:

  • 50 percent of respondents have no way of knowing if the data used in testing had been compromised.
  • 41 percent of respondents reported they do not protect live data used in software development.
  • 38 percent of respondents were unsure if live data their organization used for testing or development had been lost or stolen.
  • 26 percent of respondents said they did not know who was responsible for securing test data, 26 percent believed the development organization was responsible and 21 percent said the testing organization was responsible, suggesting no clear ownership for sensitive test data.

The white paper that summarizes these findings is located at www.compuware.com/dataprivacypaper