Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/20/2012
06:15 PM
50%
50%

How To Protect Your Commercial Web Server

Public Internet servers are among criminals’ favorite targets. Is your security strategy up to the challenge?

In February, a hacker placed a malicious program on shoe and clothing retailer Opening Ceremony's website. For more than a month, the malware collected the names, addresses, and credit card information of customers who purchased items from the site.

"We discovered the malware on March 21, 2012, immediately removed it, and implemented increased security controls to prevent this from happening in the future," Carol Lim, CEO and co-founder, wrote in a letter to customers in May.

The company offered scant details of the attacks, however, and failed to respond to our request for comment. In her letter, Lim told customers that Opening Ceremony had removed the program and hired breach-response and identity-protection firm ID Experts but only offered a terse statement, promising: "We take the privacy and security of your information very seriously and sincerely apologize for any inconvenience this may cause you."

Online retailers must do better. Criminals and hackers have taken aim at e-commerce sites, targeting them with attacks ranging from extortion attempts threatening denial-of-service attacks to the theft of credit card information to hacktivism.

For an online business, such attacks are a real problem. Many online shops aren't able to afford the basics of security. Even baseline security measures can be so expensive and cumbersome that spending on them can cut into already slim retail profits, says Joshua Corman, director of security intelligence for content-distribution network Akamai Technologies. "Even though they know what the basics are," Corman says, "they can't afford them and so they are living below the security poverty line."

For retailers facing this conundrum, here are some ways to improve security while keeping costs down.

Keep your security effort simple. Companies make different choices for how to operate their e-commerce sites. Amazon can afford to pour a foundation, build a data center, develop its own online retail site, and secure it. Most other companies do much less, using at the very least a hosting provider for their servers, if not their entire e-commerce platform.

Companies face the same range of choices for security and must craft a program that works for their business. An online shop that depends on technical features to attract customers should teach its developers secure programming. A retailer that's focusing less on features and more on its products would likely want to use an e-commerce service since adding whiz-bang widgets to its site is less important.

Focus on technologies that you can not only manage but also secure, says Bill Pennington, chief strategy officer at WhiteHat Security, a Web application security firm. E-commerce platforms can make security easier essentially by outsourcing it to the provider.

"They aren't necessarily more secure, but they are highly focused," Pennington says. "Their reputation, and thus their business, lives and breathes on their ability to make a secure platform."

Businesses also should tackle the simple problems first, such as securing communications and not leaving administration consoles open to the Internet.

In its Global Security Report, security consultancy Trustwave found that 43% of retailers used insecure protocols and 22% used insecure remote access and administration products. Among other top risks that sites face: using a default or no password, failing to use encryption, and storing information in a poorly secured database.

Plan and practice incident response. From day one, consider what types of attacks may hit your site and develop a "runbook" of scenarios and how to respond to each. Knowing who to contact and having existing relationships can dramatically speed response time to an attack and reduce the overall cost, says Paul Sop, technology evangelist with Prolexic Technologies, provider of distributed denial-of-service protection services.

"Detecting a [DDoS] attack isn't hard," Sop says. "Coming to grips with what exactly the attacker's strategy is--Are they going broad? Are they randomizing? What resources are they going after?--doing that quickly is the biggest factor in reducing downtime."

If you don't have internal expertise, a managed security provider can guide the incident response process. Just don't wait until an attack happens to contact specialists. Instead, make them part of monthly development and change-control meetings to get feedback on the security implications of any site modifications, says Dave Marcus, director of advanced research and threat intelligence at security firm McAfee, a subsidiary of Intel.

"On a per-incident basis, it can be expensive," says Marcus. "But doing it on a regular basis and collecting recommendations and advice can help prevent attacks."

Validate third-party security. Most companies deal with third-party providers. Using a service provider--whether for marketing, an e-commerce infrastructure, or payment processing--means relying on that company's security as well.

To protect your company, make sure your provider's contract spells out how the service should be used, how its software is built, and that you can test the e-commerce site at any time. In addition, go over its development process, and request code audits, or at least reports on the most recent code audit, says WhiteHat's Pennington.

If the third party pushes back vehemently against security testing, you're more likely to end up with a company that has insecure software, Pennington says. If it welcomes an audit, it "by and large, [has] far fewer vulnerabilities," he says.

An audit can also be a good way to start a conversation about security and tighten a partnership, says Wolfgang Kandek, CTO at cloud security firm Qualys. The company, which scans sites for vulnerabilities, frequently fields questions from the third-party providers who own the infrastructure, he says.

"Nobody likes to get audited," Kandek says. "But if you make the results available and are there for discussions, it can help customers become more successful."

chart: Vulnerabilities Of Typical E-Commerce Sites

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20477
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-20478
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
CVE-2011-2054
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
CVE-2015-0749
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
CVE-2015-9543
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...