Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/20/2012
06:15 PM
50%
50%

How To Protect Your Commercial Web Server

Public Internet servers are among criminals’ favorite targets. Is your security strategy up to the challenge?

In February, a hacker placed a malicious program on shoe and clothing retailer Opening Ceremony's website. For more than a month, the malware collected the names, addresses, and credit card information of customers who purchased items from the site.

"We discovered the malware on March 21, 2012, immediately removed it, and implemented increased security controls to prevent this from happening in the future," Carol Lim, CEO and co-founder, wrote in a letter to customers in May.

The company offered scant details of the attacks, however, and failed to respond to our request for comment. In her letter, Lim told customers that Opening Ceremony had removed the program and hired breach-response and identity-protection firm ID Experts but only offered a terse statement, promising: "We take the privacy and security of your information very seriously and sincerely apologize for any inconvenience this may cause you."

Online retailers must do better. Criminals and hackers have taken aim at e-commerce sites, targeting them with attacks ranging from extortion attempts threatening denial-of-service attacks to the theft of credit card information to hacktivism.

For an online business, such attacks are a real problem. Many online shops aren't able to afford the basics of security. Even baseline security measures can be so expensive and cumbersome that spending on them can cut into already slim retail profits, says Joshua Corman, director of security intelligence for content-distribution network Akamai Technologies. "Even though they know what the basics are," Corman says, "they can't afford them and so they are living below the security poverty line."

For retailers facing this conundrum, here are some ways to improve security while keeping costs down.

Keep your security effort simple. Companies make different choices for how to operate their e-commerce sites. Amazon can afford to pour a foundation, build a data center, develop its own online retail site, and secure it. Most other companies do much less, using at the very least a hosting provider for their servers, if not their entire e-commerce platform.

Companies face the same range of choices for security and must craft a program that works for their business. An online shop that depends on technical features to attract customers should teach its developers secure programming. A retailer that's focusing less on features and more on its products would likely want to use an e-commerce service since adding whiz-bang widgets to its site is less important.

Focus on technologies that you can not only manage but also secure, says Bill Pennington, chief strategy officer at WhiteHat Security, a Web application security firm. E-commerce platforms can make security easier essentially by outsourcing it to the provider.

"They aren't necessarily more secure, but they are highly focused," Pennington says. "Their reputation, and thus their business, lives and breathes on their ability to make a secure platform."

Businesses also should tackle the simple problems first, such as securing communications and not leaving administration consoles open to the Internet.

In its Global Security Report, security consultancy Trustwave found that 43% of retailers used insecure protocols and 22% used insecure remote access and administration products. Among other top risks that sites face: using a default or no password, failing to use encryption, and storing information in a poorly secured database.

Plan and practice incident response. From day one, consider what types of attacks may hit your site and develop a "runbook" of scenarios and how to respond to each. Knowing who to contact and having existing relationships can dramatically speed response time to an attack and reduce the overall cost, says Paul Sop, technology evangelist with Prolexic Technologies, provider of distributed denial-of-service protection services.

"Detecting a [DDoS] attack isn't hard," Sop says. "Coming to grips with what exactly the attacker's strategy is--Are they going broad? Are they randomizing? What resources are they going after?--doing that quickly is the biggest factor in reducing downtime."

If you don't have internal expertise, a managed security provider can guide the incident response process. Just don't wait until an attack happens to contact specialists. Instead, make them part of monthly development and change-control meetings to get feedback on the security implications of any site modifications, says Dave Marcus, director of advanced research and threat intelligence at security firm McAfee, a subsidiary of Intel.

"On a per-incident basis, it can be expensive," says Marcus. "But doing it on a regular basis and collecting recommendations and advice can help prevent attacks."

Validate third-party security. Most companies deal with third-party providers. Using a service provider--whether for marketing, an e-commerce infrastructure, or payment processing--means relying on that company's security as well.

To protect your company, make sure your provider's contract spells out how the service should be used, how its software is built, and that you can test the e-commerce site at any time. In addition, go over its development process, and request code audits, or at least reports on the most recent code audit, says WhiteHat's Pennington.

If the third party pushes back vehemently against security testing, you're more likely to end up with a company that has insecure software, Pennington says. If it welcomes an audit, it "by and large, [has] far fewer vulnerabilities," he says.

An audit can also be a good way to start a conversation about security and tighten a partnership, says Wolfgang Kandek, CTO at cloud security firm Qualys. The company, which scans sites for vulnerabilities, frequently fields questions from the third-party providers who own the infrastructure, he says.

"Nobody likes to get audited," Kandek says. "But if you make the results available and are there for discussions, it can help customers become more successful."

chart: Vulnerabilities Of Typical E-Commerce Sites

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
When Older Windows Systems Won't Die
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...
CVE-2019-11644
PUBLISHED: 2019-05-17
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premi...