l{"id":1216076,"date":"2023-04-17T16:43:49","date_gmt":"2023-04-17T15:43:49","guid":{"rendered":"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/"},"modified":"2023-04-17T16:43:49","modified_gmt":"2023-04-17T15:43:49","slug":"how-to-balance-data-access-and-security-in-fintech-testing-techtarget","status":"publish","type":"post","link":"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/","title":{"rendered":"How to balance data access and security in fintech testing &#8211; TechTarget"},"content":{"rendered":"<p> <script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- newscabal uk text -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:inline-block;width:728px;height:90px\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"3688094655\"><\/ins>\r\n<script>\r\n(adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<\/p>\n<p>In fintech, real customer data provides the most powerful and realistic software testing scenarios. Yet regulations and standards &#8212; or a company&#8217;s security team &#8212; may insist on controls or restricted permissions that make that impossible.<\/p>\n<p>The security team is not wrong. The company may be obligated to keep customers&#8217; Social Security numbers, birth dates and full names private. Anyone with personally identifiable information (PII) could use it for identity theft or fraud. In the case of PII-sensitive data, tests that include live credit card numbers can facilitate fraud and abuse.<\/p>\n<p>The testers aren&#8217;t wrong either. The best test includes conditions actually seen in production. With live data, it&#8217;s more likely the software will perform consistently across testing and production environments.<\/p>\n<p>Fortunately, there are ways to balance security with excellent testing practices. Most of these strategies are intended for transactional systems &#8212; such as those used for insurance claims processing, monthly billing and interest calculations &#8212; but they apply to any system that uses PII, where there are concerns of using production data.<\/p>\n<div id=\"\">\n<h3 class=\"section-title\"><i class=\"icon\" data-icon=\"1\"\/>6 core strategies for fintech testing<\/h3>\n<p>These six strategies can help software teams balance accurate fintech testing with data security.<\/p>\n<h4>Use a golden master<\/h4>\n<p>Most systems can export and import data, at least for backup purposes. The golden master takes that idea one step further, creating a simple example test data set. That data set has known cases, such as a user with bad credit, a user with great credit, a user under 18 who&#8217;s not able to legally contract and others.<\/p>\n<p>With consistently known good data, the team can write <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/definition\/static-testing\">static test<\/a> cases, checking the same users for the same expected results on every run. The simplest option is to store the export in version control or a test data management tool. Note that in some cases the export will have dates in it, such as the dates on an insurance claim, and the program may need to update the dates on import.<\/p>\n<h4>Mask identifiable information<\/h4>\n<p>To minimize the risk of identity theft, production <a href=\"https:\/\/www.techtarget.com\/searchsecurity\/definition\/data-masking\">data masking<\/a> takes information and changes aspects such as names, birthdays or Social Security numbers so that they are scrambled but still in valid form. This enables teams to perform realistic, accurate software tests while protecting sensitive data.<\/p>\n<p>This still leaves the problem of access to the original, pre-transformed data. Some tools exist to automate <a href=\"https:\/\/www.techtarget.com\/searchsecurity\/tip\/Data-masking-vs-data-encryption-How-do-they-differ\">data masking with security controls<\/a>, so no tester or programmer has access to the &#8220;upstream&#8221; pre-scrambled data.<\/p>\n<h4>Follow the permission principle<\/h4>\n<p>When I worked at an insurance company, I wrote a simple code library to determine if any individual person had coverage as of the current date. The <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-plan-unit-test-coverage\">unit tests<\/a> used my own personal information. It wasn&#8217;t a HIPAA violation because I granted the company permission. When I left the company, somebody else took over this strategy and maintained the code.<\/p>\n<p>This approach can work well, but isn&#8217;t ideal when running a large numbers of tests at the same time in the same database. As such, personal IDs with permission can be something to use while you wait for synthetic users.<\/p>\n<h4>Test with synthetic users<\/h4>\n<p>With this approach, there&#8217;s a code library from which testers can request a particular type of user &#8212; based, for example, on age or credit score &#8212; and get back a unique user ID. If every test asks for a new synthetic user, there won&#8217;t be &#8220;collisions&#8221; that happen in the database when the same user is reused for tests. For example, if a test applies for a loan over and over, a synthetic user could trip a new scenario where credit is overextended.<\/p>\n<h4>Partner with customer service<\/h4>\n<p>Access to some production data is usually essential for customer service. When problems come up in production from customer service, they can provide the information to debug, isolate and <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/9-techniques-for-fixing-bugs-in-production\">fix issues in production<\/a>. This is an essential aspect of testing. Formalizing this process could allow the team to access some production data some of the time.<\/p>\n<h4>Use high-volume automated testing<\/h4>\n<p>One company I worked with ran through a few thousand users every day, producing a text file that would become a mail merge. For every build, they took two golden masters of previous production data, ran the production version of the software and the new build, and compared the output. This moved their number of test cases from a few dozen over a few days to a few thousand over a couple of hours.<\/p>\n<p><a href=\"https:\/\/scholarship.law.cornell.edu\/cgi\/viewcontent.cgi?article=2798&amp;context=facpub\" target=\"_blank\" rel=\"noopener\">In regulated markets<\/a>, teams might need to combine this <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/A-comprehensive-test-automation-guide-for-IT-teams\">automated testing<\/a> approach with data masking or randomization. For example, an analysis of production users by age or credit score might make it possible to create a golden master of synthetic users that match production use.<\/p>\n<\/div>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-8162386273903324\"\r\n     data-ad-slot=\"7859258044\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><br \/>\n<br \/><a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing\">READ SOURCE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In fintech, real customer data provides the most powerful and realistic software testing scenarios. Yet regulations and standards &#8212; or a company&#8217;s security team &#8212; may insist on controls or restricted permissions that make that impossible. The security team is not wrong. The company may be obligated to keep customers&#8217; Social Security numbers, birth dates [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1000047,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_oct_exclude_from_cache":false,"footnotes":""},"categories":[53],"tags":[],"class_list":["post-1216076","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to balance data access and security in fintech testing - TechTarget - Business Telegraph<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to balance data access and security in fintech testing - TechTarget - Business Telegraph\" \/>\n<meta property=\"og:description\" content=\"In fintech, real customer data provides the most powerful and realistic software testing scenarios. Yet regulations and standards &#8212; or a company&#8217;s security team &#8212; may insist on controls or restricted permissions that make that impossible. The security team is not wrong. The company may be obligated to keep customers&#8217; Social Security numbers, birth dates [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing\" \/>\n<meta property=\"og:site_name\" content=\"Business Telegraph\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-17T15:43:49+00:00\" \/>\n<meta name=\"author\" content=\"businesstelegraph\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"businesstelegraph\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/\"},\"author\":{\"name\":\"businesstelegraph\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\"},\"headline\":\"How to balance data access and security in fintech testing &#8211; TechTarget\",\"datePublished\":\"2023-04-17T15:43:49+00:00\",\"dateModified\":\"2023-04-17T15:43:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/\"},\"wordCount\":799,\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"security\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/\",\"url\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing\",\"name\":\"How to balance data access and security in fintech testing - TechTarget - Business Telegraph\",\"isPartOf\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2023-04-17T15:43:49+00:00\",\"dateModified\":\"2023-04-17T15:43:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage\",\"url\":\"\",\"contentUrl\":\"\",\"width\":1200,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.businesstelegraph.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to balance data access and security in fintech testing &#8211; TechTarget\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#website\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"name\":\"Business Telegraph UK\",\"description\":\"business, tech and industry news\",\"publisher\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#organization\",\"name\":\"Business Telegraph UK\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"contentUrl\":\"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png\",\"width\":500,\"height\":177,\"caption\":\"Business Telegraph UK\"},\"image\":{\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78\",\"name\":\"businesstelegraph\",\"url\":\"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to balance data access and security in fintech testing - TechTarget - Business Telegraph","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing","og_locale":"en_GB","og_type":"article","og_title":"How to balance data access and security in fintech testing - TechTarget - Business Telegraph","og_description":"In fintech, real customer data provides the most powerful and realistic software testing scenarios. Yet regulations and standards &#8212; or a company&#8217;s security team &#8212; may insist on controls or restricted permissions that make that impossible. The security team is not wrong. The company may be obligated to keep customers&#8217; Social Security numbers, birth dates [&hellip;]","og_url":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing","og_site_name":"Business Telegraph","article_published_time":"2023-04-17T15:43:49+00:00","author":"businesstelegraph","twitter_card":"summary_large_image","twitter_misc":{"Written by":"businesstelegraph","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#article","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/"},"author":{"name":"businesstelegraph","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78"},"headline":"How to balance data access and security in fintech testing &#8211; TechTarget","datePublished":"2023-04-17T15:43:49+00:00","dateModified":"2023-04-17T15:43:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/"},"wordCount":799,"publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"image":{"@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage"},"thumbnailUrl":"","articleSection":["security"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.businesstelegraph.co.uk\/how-to-balance-data-access-and-security-in-fintech-testing-techtarget\/","url":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing","name":"How to balance data access and security in fintech testing - TechTarget - Business Telegraph","isPartOf":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage"},"image":{"@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage"},"thumbnailUrl":"","datePublished":"2023-04-17T15:43:49+00:00","dateModified":"2023-04-17T15:43:49+00:00","breadcrumb":{"@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#primaryimage","url":"","contentUrl":"","width":1200,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/www.techtarget.com\/searchsoftwarequality\/tip\/How-to-balance-data-access-and-security-in-fintech-testing#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.businesstelegraph.co.uk\/"},{"@type":"ListItem","position":2,"name":"How to balance data access and security in fintech testing &#8211; TechTarget"}]},{"@type":"WebSite","@id":"https:\/\/www.businesstelegraph.co.uk\/#website","url":"https:\/\/www.businesstelegraph.co.uk\/","name":"Business Telegraph UK","description":"business, tech and industry news","publisher":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.businesstelegraph.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.businesstelegraph.co.uk\/#organization","name":"Business Telegraph UK","url":"https:\/\/www.businesstelegraph.co.uk\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/","url":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","contentUrl":"https:\/\/www.businesstelegraph.co.uk\/wp-content\/uploads\/2024\/03\/business-telegraph-LOGO.png","width":500,"height":177,"caption":"Business Telegraph UK"},"image":{"@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.businesstelegraph.co.uk\/#\/schema\/person\/0a3a6a0f58402f1f2af94e02d0987b78","name":"businesstelegraph","url":"https:\/\/www.businesstelegraph.co.uk\/author\/businesstelegraph\/"}]}},"_links":{"self":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1216076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/comments?post=1216076"}],"version-history":[{"count":0,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/posts\/1216076\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/media?parent=1216076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/categories?post=1216076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.businesstelegraph.co.uk\/wp-json\/wp\/v2\/tags?post=1216076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}