Overview of Main Posts

This post gives an overview of the most important SDLC related posts in this blog.

• SDLC Quick Reference  is a a quick reference checklist of security related items you should consider addressing during the development lifecycle of your web or online project. This is the main article.

• Data Classification and Security Requirements describes how classifying the data that the application processes can be used
• Data Flow Diagrams and Security Requirements is a useful tool to help in understanding the security requirements.
• Threats - Some Thoughts  shows how to do a simple threat analysis.

• Audit Trail Basics gives an overview of the important elements of an audit trail.

• User Lifecycle - Part I  and User Lifecycle - Part II looks at the user lifecycle and important events such as logon, logoff etc.

• Session Management - Some Good Practices gives some tips on good session management practices

Is Google Analytics illegal in Germany?

Update May 25th 2012


It looks like it's OK again  to use Google Analytics in Germany 

• Use of Google Analytics Now Lawful in Germany, Subject to Certain Guidelines 
• Article in German
  

   
Today I stopped using Google Analytics (GA) on this blog. The reason is that the German Data Protection Authorities have recently said that usage of GA is illegal. They are of the opinion that the way GA uses IP addresses breaches their laws.  I know that some readers of this blog come from Germany. How do I know? Google Analytics.


This blog also uses StatCounter to analyse visitor traffic. StatCounter is based in the EU - Ireland. So that should be OK - at least in Europe. Anyway,  I prefer StatCounter so GA is no great loss.


The irony is that this blog is hosted on Google Blogger which is based in the US. This should be OK because Google is signed up to the Safe Harbor framework. This roughly means that it is acceptable to store personal information of EU citizens on Google infrastructure.

An added complication is that Google Blogger has a feature called Stats, which also offers visitor tracking functionality. This is separate to GA, so hopefully it will not be a problem. It is all a bit mind boggling!

So should you remove Google Analytics from your website?


Links:

• http://www.thelocal.de/sci-tech/20110111-32341.html
• http://www.export.gov/safeharbor/
• Google record on EU Safe Harbor list
• StatCounter 

PS:  I have just noticed that the Information Commissioner's website in the UK uses Google Analytics. So maybe he shouldn't visit Germany anytime soon.