October 13, 2016 By Rick M Robinson 2 min read

Read the fine print. It’s an old piece of advice, going back long before the first webpage ever hit the ether. But the web and app eras have made this old advice far more immediate and pervasive. Company security policies should consider the unread agreement challenge to protect customers, employees and the company itself.

Understanding Company Security Policies

Website and applications prompt us to agree to terms of service seemingly every day. Still, few of us actually read what we are agreeing to before we click on the box.

By clicking without reading, we risk exposing ourselves to security hazards and legal ramifications. Users might agree to downloading cookies or other intrusive software onto their devices, for example, or sign over their original words or media to another firm’s intellectual property.

Checking the Box

In the days before the internet, reading the fine print was important advice for relatively rare occasions. Few people encountered detailed legal contracts on a daily basis. Today, these agreements are a fact of everyday life.

Simply reading a webpage or using an application might require agreeing to terms of service. This seems to fly in the face of the internet’s promise of convenience and speed. We want to use the application now, not spend hours rifling through confusing legalese.

For companies and the those tasked with devising company security policies, the challenge of reading the fine print goes in both directions. Not only should security executives be reading the fine print themselves in an effort to protect the business, but they also need to encourage their customers to read their fine print.

Jettison the Jargon

Legal language has a bad reputation because it is technical jargon. Like all jargon, it seems mysterious to laypeople, filled with long words and ordinary words used in odd ways. To a lawyer, however, it is clear and exact. It is also legally necessary.

For this reason, efforts to write terms of service in everyday language are usually doomed to fail. Instead of making agreements clearer, common language can be vague or even misleading. Unfortunately, simple language generally does not fit the requirements of legal or regulatory compliance.

The language of online terms and conditions can still be improved, however. Legal and marketing departments can work together to craft agreements that are easier to understand while still meeting legal standards of precision. As NPR reported, Apple took the unusual step of presenting the iTunes terms of service in the form of a graphic novel to encourage users to actually read and understand what they were agreeing to.

The Fine Print

To be sure, these challenges will not go away. For example, Apple might need to consider its rights to the iTunes agreement as a literary property, which presents a whole new challenge for a contractual legal agreement. But every improvement to terms of service and related documents will save users and vendors alike a lot of frustration, aggravation and potential legal fees.

More from Risk Management

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

When you shouldn’t patch: Managing your risk factors

4 min read - Look at any article with advice about best practices for cybersecurity, and about third or fourth on that list, you’ll find something about applying patches and updates quickly and regularly. Patching for known vulnerabilities is about as standard as it gets for good cybersecurity hygiene, right up there with using multi-factor authentication and thinking before you click on links in emails from unknown senders.So imagine my surprise when attending Qualys QSC24 in San Diego to hear a number of conference…

CISOs drive the intersection between cyber maturity and business continuity

4 min read - The modern corporate landscape is marked by rapid digital change, heightened cybersecurity threats and an evolving regulatory environment. At the nexus of these pressures sits the chief information security officer (CISO), a role that has gained newfound influence and responsibility.The recent Deloitte Global Future of Cyber Survey underscores this shift, revealing that “being more cyber mature does not make organizations immune to threats; it makes them more resilient when they occur, enabling critical business continuity.” High-cyber-maturity organizations increasingly integrate cybersecurity…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today