Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Top 5 Reasons Your Small Business Website is Under Attack
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 7:05:13 AM
Re: What about solutions? >Early Trends in Hosting
I find it really interesting that web hosting companies are looking to offer 3rd party website security services tailored for the small biz market because of the increasing cost for them to repair hacked sites....  That's something to consider when choosing a web hosting vendor. 
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
8/27/2014 | 9:38:51 AM
Re: What about solutions?
I'm surprised we don't see more small business solutions around Web Application Firewalls (WAF) or DDoS.  These are great ways to limit the risk of malicious traffic and can be offered as hosted solutions.
Biffster
50%
50%
Biffster,
User Rank: Apprentice
8/27/2014 | 9:48:17 AM
Automation
Nice article.  What I like about the author's company 6Scan, is their emphasis on automation to improve website safety and security.  It is a complicated world out there.  Thanks for making it a little simpler.  Imagine how effective the air bags in your car would be if you had to operate them manually.  Automation is the key, especially for small business sites.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/27/2014 | 12:17:52 PM
Don't bother without security
This is why I feel like I'm stomping on people's ideas everytime a friend tells me they've come up with a clever business idea that involves a website. If they don't know how to handle security themselves and can't afford to hire someone to do it for them, it seems doomed to fail. 

When your reputationo can be ruined so easly, it's going to become much harder to startup internet based businesses, without some serious capital funding to help shore up defenses, preemptively and after the fact. 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:37:11 PM
Re: What about solutions?
WAFs are a valuable layer in website security. Companies that don't have dedicated IT resources may want a "security suite" approach that includes vulnerability and malware scanning and remediation as well. On the DDoS side its not a particular concern for smaller businesses, the bigger threat for them is being hacked and co-opted into a botnet that will participate in the actual DDoS attack.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:38:08 PM
Re: Automation
I like the analogy. I may borrow that one. Thanks!
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:45:37 PM
Re: Don't bother without security
Unfortunately security is often the last thing to be addressed in a website launch plan (if it's addressed at all) and the more dynamic a site is, the greater the attack surface is likely to be. We're hoping to raise the awareness that big names make the big news (Target, etc) but the majority iof attacks target smaller businesses. The cost is also coming down so it should be attainable for almost all start-ups.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:48:54 PM
Re: What about solutions? >Early Trends in Hosting
Exactly. The incremental premium for a hosting service that takes security seriously is negligible compared to the lost revenue/reputation if your company's website gets placed on the Google blacklist/blocklist.
cherr552
50%
50%
cherr552,
User Rank: Apprentice
8/27/2014 | 8:02:34 PM
How do non-techie small businesses get security advice?
Many small businesses have a web presence, but no tech expertise--their web sites are developed by designers or consultants, who rarely return to maintain what they've built. 



In the setup-and-forget model, the site builders make recommendations about the hosting provider, and they should be able to recommend a security provider as well.  After all, their reputation depends on building sites that perform well (for their customers--the small businesses).
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 9:57:16 PM
Re: How do non-techie small businesses get security advice?
This rather common -- a small company has a problem with their site but the developer did it as a one-off project and is no longer actively engaged. You make a great point, when hiring a developer companies should ask for an ongoing plan to maintain the security of the site.
<<   <   Page 2 / 3   >   >>


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-22168
PUBLISHED: 2021-06-22
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVE-2020-22169
PUBLISHED: 2021-06-22
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\appointment-history.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVE-2020-22170
PUBLISHED: 2021-06-22
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVE-2020-22171
PUBLISHED: 2021-06-22
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVE-2020-22172
PUBLISHED: 2021-06-22
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.