Attacks/Breaches
8/20/2012
06:15 PM
Connect Directly
RSS
E-Mail
50%
50%

How To Protect Your Commercial Web Server

Public Internet servers are among criminals’ favorite targets. Is your security strategy up to the challenge?

In February, a hacker placed a malicious program on shoe and clothing retailer Opening Ceremony's website. For more than a month, the malware collected the names, addresses, and credit card information of customers who purchased items from the site.

"We discovered the malware on March 21, 2012, immediately removed it, and implemented increased security controls to prevent this from happening in the future," Carol Lim, CEO and co-founder, wrote in a letter to customers in May.

The company offered scant details of the attacks, however, and failed to respond to our request for comment. In her letter, Lim told customers that Opening Ceremony had removed the program and hired breach-response and identity-protection firm ID Experts but only offered a terse statement, promising: "We take the privacy and security of your information very seriously and sincerely apologize for any inconvenience this may cause you."

Online retailers must do better. Criminals and hackers have taken aim at e-commerce sites, targeting them with attacks ranging from extortion attempts threatening denial-of-service attacks to the theft of credit card information to hacktivism.

For an online business, such attacks are a real problem. Many online shops aren't able to afford the basics of security. Even baseline security measures can be so expensive and cumbersome that spending on them can cut into already slim retail profits, says Joshua Corman, director of security intelligence for content-distribution network Akamai Technologies. "Even though they know what the basics are," Corman says, "they can't afford them and so they are living below the security poverty line."

For retailers facing this conundrum, here are some ways to improve security while keeping costs down.

Keep your security effort simple. Companies make different choices for how to operate their e-commerce sites. Amazon can afford to pour a foundation, build a data center, develop its own online retail site, and secure it. Most other companies do much less, using at the very least a hosting provider for their servers, if not their entire e-commerce platform.

Companies face the same range of choices for security and must craft a program that works for their business. An online shop that depends on technical features to attract customers should teach its developers secure programming. A retailer that's focusing less on features and more on its products would likely want to use an e-commerce service since adding whiz-bang widgets to its site is less important.

Focus on technologies that you can not only manage but also secure, says Bill Pennington, chief strategy officer at WhiteHat Security, a Web application security firm. E-commerce platforms can make security easier essentially by outsourcing it to the provider.

"They aren't necessarily more secure, but they are highly focused," Pennington says. "Their reputation, and thus their business, lives and breathes on their ability to make a secure platform."

Businesses also should tackle the simple problems first, such as securing communications and not leaving administration consoles open to the Internet.

In its Global Security Report, security consultancy Trustwave found that 43% of retailers used insecure protocols and 22% used insecure remote access and administration products. Among other top risks that sites face: using a default or no password, failing to use encryption, and storing information in a poorly secured database.

Plan and practice incident response. From day one, consider what types of attacks may hit your site and develop a "runbook" of scenarios and how to respond to each. Knowing who to contact and having existing relationships can dramatically speed response time to an attack and reduce the overall cost, says Paul Sop, technology evangelist with Prolexic Technologies, provider of distributed denial-of-service protection services.

"Detecting a [DDoS] attack isn't hard," Sop says. "Coming to grips with what exactly the attacker's strategy is--Are they going broad? Are they randomizing? What resources are they going after?--doing that quickly is the biggest factor in reducing downtime."

If you don't have internal expertise, a managed security provider can guide the incident response process. Just don't wait until an attack happens to contact specialists. Instead, make them part of monthly development and change-control meetings to get feedback on the security implications of any site modifications, says Dave Marcus, director of advanced research and threat intelligence at security firm McAfee, a subsidiary of Intel.

"On a per-incident basis, it can be expensive," says Marcus. "But doing it on a regular basis and collecting recommendations and advice can help prevent attacks."

Validate third-party security. Most companies deal with third-party providers. Using a service provider--whether for marketing, an e-commerce infrastructure, or payment processing--means relying on that company's security as well.

To protect your company, make sure your provider's contract spells out how the service should be used, how its software is built, and that you can test the e-commerce site at any time. In addition, go over its development process, and request code audits, or at least reports on the most recent code audit, says WhiteHat's Pennington.

If the third party pushes back vehemently against security testing, you're more likely to end up with a company that has insecure software, Pennington says. If it welcomes an audit, it "by and large, [has] far fewer vulnerabilities," he says.

An audit can also be a good way to start a conversation about security and tighten a partnership, says Wolfgang Kandek, CTO at cloud security firm Qualys. The company, which scans sites for vulnerabilities, frequently fields questions from the third-party providers who own the infrastructure, he says.

"Nobody likes to get audited," Kandek says. "But if you make the results available and are there for discussions, it can help customers become more successful."

chart: Vulnerabilities Of Typical E-Commerce Sites

Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.