October 13, 2016 By Rick M Robinson 2 min read

Read the fine print. It’s an old piece of advice, going back long before the first webpage ever hit the ether. But the web and app eras have made this old advice far more immediate and pervasive. Company security policies should consider the unread agreement challenge to protect customers, employees and the company itself.

Understanding Company Security Policies

Website and applications prompt us to agree to terms of service seemingly every day. Still, few of us actually read what we are agreeing to before we click on the box.

By clicking without reading, we risk exposing ourselves to security hazards and legal ramifications. Users might agree to downloading cookies or other intrusive software onto their devices, for example, or sign over their original words or media to another firm’s intellectual property.

Checking the Box

In the days before the internet, reading the fine print was important advice for relatively rare occasions. Few people encountered detailed legal contracts on a daily basis. Today, these agreements are a fact of everyday life.

Simply reading a webpage or using an application might require agreeing to terms of service. This seems to fly in the face of the internet’s promise of convenience and speed. We want to use the application now, not spend hours rifling through confusing legalese.

For companies and the those tasked with devising company security policies, the challenge of reading the fine print goes in both directions. Not only should security executives be reading the fine print themselves in an effort to protect the business, but they also need to encourage their customers to read their fine print.

Jettison the Jargon

Legal language has a bad reputation because it is technical jargon. Like all jargon, it seems mysterious to laypeople, filled with long words and ordinary words used in odd ways. To a lawyer, however, it is clear and exact. It is also legally necessary.

For this reason, efforts to write terms of service in everyday language are usually doomed to fail. Instead of making agreements clearer, common language can be vague or even misleading. Unfortunately, simple language generally does not fit the requirements of legal or regulatory compliance.

The language of online terms and conditions can still be improved, however. Legal and marketing departments can work together to craft agreements that are easier to understand while still meeting legal standards of precision. As NPR reported, Apple took the unusual step of presenting the iTunes terms of service in the form of a graphic novel to encourage users to actually read and understand what they were agreeing to.

The Fine Print

To be sure, these challenges will not go away. For example, Apple might need to consider its rights to the iTunes agreement as a literary property, which presents a whole new challenge for a contractual legal agreement. But every improvement to terms of service and related documents will save users and vendors alike a lot of frustration, aggravation and potential legal fees.

More from Risk Management

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

How cyberattacks on grocery stores could threaten food security

4 min read - Grocery store shoppers at many chains recently ran into an unwelcome surprise: empty shelves and delayed prescriptions. In early November, Ahold Delhaize USA was the victim of a cyberattack that significantly disrupted operations at more than 2,000 stores, including Hannaford, Food Lion and Stop and Shop. Specific details of the nature of the attack have not yet been publicly released.Because the attack affected many digital systems, some stores were not able to accept credit/debit cards, while others had to shut…

Taking the fight to the enemy: Cyber persistence strategy gains momentum

4 min read - The nature of cyber warfare has evolved rapidly over the last decade, forcing the world’s governments and industries to reimagine their cybersecurity strategies. While deterrence and reactive defenses once dominated the conversation, the emergence of cyber persistence — actively hunting down threats before they materialize — has become the new frontier. This shift, spearheaded by the United States and rapidly adopted by its allies, highlights the realization that defense alone is no longer enough to secure cyberspace.The momentum behind this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today