Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Top 5 Reasons Your Small Business Website is Under Attack
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
User Rank: Apprentice
8/27/2014 | 8:02:34 PM
How do non-techie small businesses get security advice?
Many small businesses have a web presence, but no tech expertise--their web sites are developed by designers or consultants, who rarely return to maintain what they've built. 

In the setup-and-forget model, the site builders make recommendations about the hosting provider, and they should be able to recommend a security provider as well.  After all, their reputation depends on building sites that perform well (for their customers--the small businesses).
Chris Weltzien
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:48:54 PM
Re: What about solutions? >Early Trends in Hosting
Exactly. The incremental premium for a hosting service that takes security seriously is negligible compared to the lost revenue/reputation if your company's website gets placed on the Google blacklist/blocklist.
Chris Weltzien
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:45:37 PM
Re: Don't bother without security
Unfortunately security is often the last thing to be addressed in a website launch plan (if it's addressed at all) and the more dynamic a site is, the greater the attack surface is likely to be. We're hoping to raise the awareness that big names make the big news (Target, etc) but the majority iof attacks target smaller businesses. The cost is also coming down so it should be attainable for almost all start-ups.
Chris Weltzien
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:38:08 PM
Re: Automation
I like the analogy. I may borrow that one. Thanks!
Chris Weltzien
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:37:11 PM
Re: What about solutions?
WAFs are a valuable layer in website security. Companies that don't have dedicated IT resources may want a "security suite" approach that includes vulnerability and malware scanning and remediation as well. On the DDoS side its not a particular concern for smaller businesses, the bigger threat for them is being hacked and co-opted into a botnet that will participate in the actual DDoS attack.
User Rank: Ninja
8/27/2014 | 12:17:52 PM
Don't bother without security
This is why I feel like I'm stomping on people's ideas everytime a friend tells me they've come up with a clever business idea that involves a website. If they don't know how to handle security themselves and can't afford to hire someone to do it for them, it seems doomed to fail. 

When your reputationo can be ruined so easly, it's going to become much harder to startup internet based businesses, without some serious capital funding to help shore up defenses, preemptively and after the fact. 
User Rank: Apprentice
8/27/2014 | 9:48:17 AM
Nice article.  What I like about the author's company 6Scan, is their emphasis on automation to improve website safety and security.  It is a complicated world out there.  Thanks for making it a little simpler.  Imagine how effective the air bags in your car would be if you had to operate them manually.  Automation is the key, especially for small business sites.
User Rank: Moderator
8/27/2014 | 9:38:51 AM
Re: What about solutions?
I'm surprised we don't see more small business solutions around Web Application Firewalls (WAF) or DDoS.  These are great ways to limit the risk of malicious traffic and can be offered as hosted solutions.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 7:05:13 AM
Re: What about solutions? >Early Trends in Hosting
I find it really interesting that web hosting companies are looking to offer 3rd party website security services tailored for the small biz market because of the increasing cost for them to repair hacked sites....  That's something to consider when choosing a web hosting vendor. 
Chris Weltzien
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:52:35 AM
Re: What about solutions?
Paul you point out a common misconception. Most hosting companies provide security only for the web server itself, not the websites that reside on the server. Often small business owners don't have the time or resources to drill down on this critical delineation. Fortunately, there is an early trend in the hosting space to offer 3rd party website security services tailored for this market (the cost for hosting companies to keep repairing hacked sites is becoming a significant burden). At 6Scan our automated service is an advanced low-touch solution designed for small businesses and there are a few other options including SiteLock and Sucuri.
<<   <   Page 2 / 3   >   >>

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to &quot;Welcome&quot; followed by the username, the usern...
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
PUBLISHED: 2022-07-02
** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input.
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.