How To Protect Your Commercial Web Server
Public Internet servers are among criminals’ favorite targets. Is your security strategy up to the challenge?
In February, a hacker placed a malicious program on shoe and clothing retailer Opening Ceremony's website. For more than a month, the malware collected the names, addresses, and credit card information of customers who purchased items from the site.
More Security Insights
- Forrester Study: The Total Economic Impact of VMware View
- Securing Executives and Highly Sensitive Documents of Corporations Globally
"We discovered the malware on March 21, 2012, immediately removed it, and implemented increased security controls to prevent this from happening in the future," Carol Lim, CEO and co-founder, wrote in a letter to customers in May.
The company offered scant details of the attacks, however, and failed to respond to our request for comment. In her letter, Lim told customers that Opening Ceremony had removed the program and hired breach-response and identity-protection firm ID Experts but only offered a terse statement, promising: "We take the privacy and security of your information very seriously and sincerely apologize for any inconvenience this may cause you."
Online retailers must do better. Criminals and hackers have taken aim at e-commerce sites, targeting them with attacks ranging from extortion attempts threatening denial-of-service attacks to the theft of credit card information to hacktivism.
For an online business, such attacks are a real problem. Many online shops aren't able to afford the basics of security. Even baseline security measures can be so expensive and cumbersome that spending on them can cut into already slim retail profits, says Joshua Corman, director of security intelligence for content-distribution network Akamai Technologies. "Even though they know what the basics are," Corman says, "they can't afford them and so they are living below the security poverty line."
For retailers facing this conundrum, here are some ways to improve security while keeping costs down.
Keep your security effort simple. Companies make different choices for how to operate their e-commerce sites. Amazon can afford to pour a foundation, build a data center, develop its own online retail site, and secure it. Most other companies do much less, using at the very least a hosting provider for their servers, if not their entire e-commerce platform.
Companies face the same range of choices for security and must craft a program that works for their business. An online shop that depends on technical features to attract customers should teach its developers secure programming. A retailer that's focusing less on features and more on its products would likely want to use an e-commerce service since adding whiz-bang widgets to its site is less important.
Focus on technologies that you can not only manage but also secure, says Bill Pennington, chief strategy officer at WhiteHat Security, a Web application security firm. E-commerce platforms can make security easier essentially by outsourcing it to the provider.
"They aren't necessarily more secure, but they are highly focused," Pennington says. "Their reputation, and thus their business, lives and breathes on their ability to make a secure platform."
Businesses also should tackle the simple problems first, such as securing communications and not leaving administration consoles open to the Internet.
In its Global Security Report, security consultancy Trustwave found that 43% of retailers used insecure protocols and 22% used insecure remote access and administration products. Among other top risks that sites face: using a default or no password, failing to use encryption, and storing information in a poorly secured database.
Plan and practice incident response. From day one, consider what types of attacks may hit your site and develop a "runbook" of scenarios and how to respond to each. Knowing who to contact and having existing relationships can dramatically speed response time to an attack and reduce the overall cost, says Paul Sop, technology evangelist with Prolexic Technologies, provider of distributed denial-of-service protection services.
"Detecting a [DDoS] attack isn't hard," Sop says. "Coming to grips with what exactly the attacker's strategy is--Are they going broad? Are they randomizing? What resources are they going after?--doing that quickly is the biggest factor in reducing downtime."
If you don't have internal expertise, a managed security provider can guide the incident response process. Just don't wait until an attack happens to contact specialists. Instead, make them part of monthly development and change-control meetings to get feedback on the security implications of any site modifications, says Dave Marcus, director of advanced research and threat intelligence at security firm McAfee, a subsidiary of Intel.
"On a per-incident basis, it can be expensive," says Marcus. "But doing it on a regular basis and collecting recommendations and advice can help prevent attacks."
Validate third-party security. Most companies deal with third-party providers. Using a service provider--whether for marketing, an e-commerce infrastructure, or payment processing--means relying on that company's security as well.
To protect your company, make sure your provider's contract spells out how the service should be used, how its software is built, and that you can test the e-commerce site at any time. In addition, go over its development process, and request code audits, or at least reports on the most recent code audit, says WhiteHat's Pennington.
If the third party pushes back vehemently against security testing, you're more likely to end up with a company that has insecure software, Pennington says. If it welcomes an audit, it "by and large, [has] far fewer vulnerabilities," he says.
An audit can also be a good way to start a conversation about security and tighten a partnership, says Wolfgang Kandek, CTO at cloud security firm Qualys. The company, which scans sites for vulnerabilities, frequently fields questions from the third-party providers who own the infrastructure, he says.
"Nobody likes to get audited," Kandek says. "But if you make the results available and are there for discussions, it can help customers become more successful."