Practically every business must fear—or at least be wary of—the threat of cyberattacks. This is especially true for businesses that process, transmit, or store payment data. It’s very likely that your business performs one of if not all three of those actions. If that’s the case, then you’re required to follow the Payment Card Industry Data Security Standard (PCI-DSS). Additionally, it’s strongly encouraged that you conduct biannual PCI network segmentation testing.
Blog
-
The Anatomy of a Vulnerability Assessment Questionnaire
As technology has advanced rapidly in recent years, the information technology infrastructures that companies rely upon have become more automated and interwoven than ever. While much of this progress has been good for business – and the world as a whole – it has also exposed new cybersecurity vulnerabilities.
-
How Zero Trust Architecture Helps Secure the Cloud
Cloud technology has revolutionized the way businesses operate all across the world. Cloud servers enable any company to leverage others’ computing capabilities to mobilize their own workforces, enabling greater flexibility in all business operations. Whether it’s enabling the storage of sensitive data or work from home, the cloud is key to all businesses’ future.
-
Can You Really Afford PCI Non Compliance?
It’s surprising how many businesses ask this question. Sometimes the cost of meeting compliance regulation seems to outweigh the risks. There are fees associated with not meeting the payment card industry (PCI) compliance regulations, but are these fines comparable to the cost of implementing the required cybersecurity protocols?
-
What are the ADA Compliance Rules?
The Americans with Disabilities Act (ADA) was created to ensure that people with disabilities are able to fully interact with the world around them no matter their handicap. It was originally created as a set of general nondiscrimination requirements for employers.
Over the years its rules and standards have expanded, going so far as to impact website design. But why would a website need to follow ADA compliance rules and what do those entail? Let’s review so that you can ensure that your business is accessible by all potential customers.
ADA Compliance
At its core, ADA compliance is all about ensuring that every American has fair access to the same goods and services. In this case, the internet.
The CDC reports that more than one in four Americans have some type of disability. This breaks down into the following categories:
- Mobility – 13.7 percent
- Cognition – 10.8 percent
- Independent living – 6.8 percent
- Hearing – 5.9 percent
- Vision – 4.6 percent
- Self-care – 3.7 percent
The advent of the internet opened up a world of new possibilities. This is particularly true for people with disabilities, who suddenly had opportunities to access information and interact in new ways. The problem was that much of the print, audio, and visual media was restricted to the “fully able”—those who didn’t have physiological issues or impairments to their speech, vision, or hearing.
Most websites and technologies weren’t initially designed or created with disabled people in mind.
Whether it was intentional or not, this practice was exclusionary.
[su_button url=”https://www.rsisecurity.com/compliance-advisory-services/ada-website/” target=”blank” style=”flat” size=”11″]Assess your ADA Compliance [/su_button]
Who Must Abide by the ADA Compliance Rules for Websites?
The ADA rules for websites are intended to ensure internet accessibility to all; however, this creates a problem since there’s no universal federal compliance directions. In fact, there are only certain entities that are required to have their website fall within ADA compliance.
Currently, the only websites required to be ADA compliant are those that can be considered “public accommodating.”
There’s plenty of wiggle room within this definition, but it can be broadly applied to:
- Governmental websites (local, state & federal)
- E-commerce platforms
- Nonprofits
- B2C websites
Even if you don’t fall into one of these categories, that doesn’t mean you won’t run into trouble. So, just to be safe, discuss your status with your attorney or an ADA specialist. They’ll help you identify whether or not your website needs to be updated for ADA compliance.
How Do You Make Your Website ADA Compliant?
As with other elements of the ADA, internet accessibility is a vague phrase. To make matters worse the ADA doesn’t have clear guidelines to ensure that you are ADA compliant.
So, how do you achieve ADA compliance?
Most organizations have decided to use the Web Content Accessibility Guidelines (WCAG) as their basic framework. These include the following website accessibility standards:
Here are a few more articles to help you learn more about ADA Compliance:
#1 Perceivable
This means that all information and components of the website must be displayed in ways that the user can perceive, even if their vision or sight is impaired. Perceptibility can be broken down into one of two primary categories, including:
- Text Alternatives – Provide text alternatives for non-text content so it can be translated into other mediums, including:
- Braille
- Audio
- Symbols
- Larger print
- Simpler language
- Time-Based Media – Present translatable substitutes for time-based media—whether audio-only or video only. Alternatives may include captions, audio description, sign language, or extended audio description.
So, if you have content, there needs to be other ways for people to get that information.
#2 Adaptable
Content must be capable of being presented in alternative formats and layouts without losing context, information, or overall structure. Factors that require consideration include:
- Info and Relationships – Make all information, structure, and relationships on a webpage available in text or as a “programmatically determined” element.
- Meaningful Sequence – Present information in a correct reading sequence.
- Sensory Characteristics – Don’t use instructions that utilize sensory characteristics i.e., sound, color, size, shape, etc.
- Orientation – Be sure that content doesn’t limit how you see and use it to a single display setting like portrait or landscape mode.
It’s better for everyone if content is translatable and then accessible on a variety of different readers, devices, and screens.
#3 Distinguishable
Content should be easy to see and hear for people with audio and visual disabilities. For starters this includes separating the foreground and the background. You must consider:
- Use of Color – Color can’t be the only visual means of providing information or prompting a response.
- Audio Control – If audio is played automatically on a webpage for more than 3 seconds, provide the user with easy and obvious ways to control the audio or volume.
- Contrast – Give text and images of text a contrast ratio that’s at least 4.5:1, except for large text, incidental text, or logos.
- Resize text – Images of text and text itself must be resizable without assistive tech up to 200 percent without losing the gist of the content or the overall functionality.
Even for people who have a mild eyesight condition, it’s paramount that your website’s content is resizable and conspicuous.
#4 Operable
Both the interface components as well as the navigation must be operable, particularly for people who can’t use a mouse. To ensure operabiliity you must address:
- Keyboard – Make all content needs operable via just a keyboard’s interface. The entire page must be navigable solely using keyboard inputs.
- Character Key Shortcuts – If there are keyboard shortcuts in content, program the ability to either:
-
- Toggle it off
- Remap the shortcuts
- Activate only when the component has focus
- Enough Time – Allow users enough time to read and then use the content.
- Seizure and Physical Reactions – Never design content in a way that causes the reader to have a physical reaction (such as a jumpscare) or cause seizures (such as flashing screens).
Your website should be easy to operate, even for users who require voice navigation or keyboard inputs.
#5 Understandable
All user interfaces must present information in an easily understandable manner.
The content needs to be:
- Readable – Use language, diction, abbreviations, and other linguistic forms that are easy to read for both a user and a programmable reader.
- Predictable – Ensure that all web pages appear and operate in predictable ways. This means consistent navigation, identification, and focus.
- Input Assistance – Help users highlight, avoid, or correct input mistakes and errors.
The above ensures that users and devices can translate content and make it digestible. And finally, (without delving too deeply into the subject), it’s critical that content is robust enough that assistive technologies are able to interpret it.
Penalties for ADA Noncompliance
So, what are the risks of not complying with the ADA?
Like the rules themselves, ADA noncompliance penalties are unclear. The most common instances tend to result in an elongated liability suit.
If that were to occur to you, it could result in:
- Settlements
- Legal Fees
- Damages
- Reputational harm
- Cost of rebuilding the website to comply
As of now the only websites that are legally mandated to be ADA compliant are those defined as “public accommodating.” According to Big Drop,
Most of the ADA website compliance lawsuits that we’ve seen thus far have fallen under one of these categories (A disabled person applying for a job, trying to purchase an item, or attempting to enroll at a college) If a person is unable to apply for employment or enrollment at a university online due to their disability, that person would have a strong case for discrimination in court.
In 2017, the New York Times reported that more than eight ADA website compliance lawsuits were filed across the state of New York in the space of a few weeks.
ADA Compliance Rules
While the ADA compliance rules are vague and frequently applied in an uneven fashion, it’s vital that your website is accessible to everyone.
This is particularly true if you operate within the following spaces:
- Governmental websites (local, state & federal)
- E-commerce platforms
- Nonprofits
- B2C websites
Even if you don’t fall into one of these categories, it’s vital that you update your website so it’s accessible to more customers.
With the uncertainty surrounding ADA compliance, trying to identify how to render your UI “compliant” is no easy task. Given the nuances, enlisting the help of ADA compliance experts will streamline the process, close any liability gaps, and identify areas of misalignment.
The team at RSI Security are experts in ADA website compliance. We can ensure that your website is nondiscriminatory.
Speak with an ADA compliance expert today – Schedule a free consultation
-
Patch Management Checklist: Back to the Basics
Because of the way software and firmware are developed and released, they sometimes, if not often contain bugs or dysfunctional code that creates problems with functionality and security. That’s why Patch Management is critical. In fact, between the years 2003 and 2005, more than 2,000 vulnerabilities were identified per year in an average system, which resulted in approximately 7 vulnerabilities per day! This means even a single server business will be dealing with several bugs each month. To find out more about specific bugs or vulnerabilities that have been found and published in the systems you administer, check out the National Vulnerability Database.
-
How do Access Controls Affect Data Center Security?
Keeping data centers secure is paramount, but this isn’t always easy for businesses to accomplish. It often depends on the location of the data center, along with the number of devices that can access it. Having access controls in place can improve security in and around data centers, but companies also need to know which ones are necessary.
-
Guide to Third-Party Risk Management Software
Third-party vendors and suppliers play an important role in a business’s success. As part of the supply chain, whether it’s services or goods, companies rely on their third-party partners. This often results in a chain of connections between the business and supplier that hackers can potentially exploit. A cybersecurity breach can disrupt the supply chain, and also result in non-compliance fines and penalties.
-
Update on PCI DSS 3.2 Password Security Requirements
If your company processes payments using credit cards, you’re required to maintain compliance with standards set out by the Payment Card Industry (PCI) Security Standards Council (SSC).
-
How to Implement Third-Party Risk Management Policies
Businesses rely on their third-party suppliers to deliver products or services on time, while also keeping costs down and improving profitability. However, as beneficial as third-party relationships are to the organization, it does come with risks. These include security breaches and data thefts that often result in non-compliance penalties and loss of consumer trust. Supply chains can also be interrupted.