Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Top 5 Reasons Your Small Business Website is Under Attack
Threaded  |  Newest First  |  Oldest First
MikeR519
100%
0%
MikeR519,
User Rank: Apprentice
8/26/2014 | 2:59:39 PM
a good read - important for small business owners
Good read, Chris.  Hacking and phishing attacks are happening all the time.  This morning, I got an email from an attorney I know, asking me to look at something on Google Docs.  The link to the supposed "doc" went to a script on a Canadian Maui Beach rental site.  Neither the attorney nor the small business in Canada knew that their accounts or websites had been attacked.  It's happening all the time and the attacks are getting better and better.  I never click anything without pasting the URL to Notepad first and examining it to make sure it points to where I think it should.

 

 
Chris Weltzien
100%
0%
Chris Weltzien,
User Rank: Author
8/26/2014 | 3:12:18 PM
Re: a good read - important for small business owners
Thanks for the input Mike! Your example is straight from the hackers playbook. By taking control of one small vacation rental site they can wreak havoc. Now scale that by 200,000,000 active public facing websites and you see the scope of the threat! The Cyber Vor guys hacked 450,000 sites (about 0.5% of the total universe) and stole BILLIONS of credentials.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/26/2014 | 4:41:54 PM
Re: a good read - important for small business owners
Chris, What do you think is the worst mistake small businesses make when it comes to securing their websites?
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/26/2014 | 6:46:51 PM
Re: a good read - important for small business owners
Good question Marilyn. Unfortunately, we see many "worst mistakes" being made. The best catch all advice is for a small business to treat their website as if it were a PC. Everything that has been hammered home about PC security applies to the website -- admins need to have secure passwords, applications need to be updated, daily security scans should be scheduled and problems need to be fixed -- and someone needs to have the explicit responsibility within the company for making sure this happens.
wkilmer
50%
50%
wkilmer,
User Rank: Apprentice
8/26/2014 | 7:53:02 PM
Re: a good read - important for small business owners
Chris, you laid out the issues well.  I have worked with a lot of company boards recently and have been interested at how concerned they are about vulnerabilities and website hacking. Without those assurances that come from vulnerabiltiy scanning I think many companies run the risk of losing potential customers that may not even do business with them.  Is there, in your opinion, a way for small businesses that do take their website security seriously to make that an advantage for them with regards to winning new customers over their competitors?
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
8/29/2014 | 9:25:41 AM
Re: a good read - important for small business owners
A key reason for continued attacks on SMBs is their bank accounts. An SMB can get a significantly larger line of credit than an individual, yet most SMBs don't track their "identities" as closely as individuals do. And oh, by the way, banks don't simply reimburse SMBs for fraudulent charges as they do for individuals.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/31/2014 | 8:37:37 AM
Re: a good read - important for small business owners
Is the reason for why they are typically less vigilant with their bank accounts due to lack of resources? I feel their should be a finance analyst that would track changes to the account on a daily basis.

Also, how come the same fraud measures aren't taken for SMB's?
Howard Fried
50%
50%
Howard Fried,
User Rank: Apprentice
8/26/2014 | 5:08:02 PM
Keep your website fresh, valuable and alive!
Not only is your guidance "on point", but it is also a good reminder that you should never ignore your website. If you "set it and forget it", likely so will your readers or potential customers. Keeping the content on your website relevant and up to date is just as important as keeping it safe for your visitors. By paying attention to your content and message on a regular basis, you engage your visitors and bring them back again. It is hard enough to get the first visit, so don't blow it by getting your site visitors infected with malware or trojans. As you clearly demonstrate, getting your website hacked can happen easily to anyone. Setting up automated monitoring is a powerful step toward keeping everyone safe. Valuable and timely article.

 

 

 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/26/2014 | 10:13:11 PM
Re: Keep your website fresh, valuable and alive!
Exactly, Howard. Its a dynamic world, and small businesses in particular need to make sure their websites as up to date with information and security. 
Corey Bridges
100%
0%
Corey Bridges,
User Rank: Apprentice
8/26/2014 | 7:57:51 PM
Sobering!
Good lord--I had no idea that sites were so vulnerable. I've got several small sites--and one soon-to-be-big site; I had definitely been in the "We're too small to be a target" mindset, but now I consider myself schooled. I suppose I shouldn't be surprised--the game of "leapfrog" between hacker and defender is ongoing.
Paul V.W825
50%
50%
Paul V.W825,
User Rank: Apprentice
8/26/2014 | 10:22:25 PM
What about solutions?
Small business owner have other things to worry about than defeating "hackers" (like thier actual business). Don't website hosting providers have something in place so that I don't have to worry about this stuff?
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:52:35 AM
Re: What about solutions?
Paul you point out a common misconception. Most hosting companies provide security only for the web server itself, not the websites that reside on the server. Often small business owners don't have the time or resources to drill down on this critical delineation. Fortunately, there is an early trend in the hosting space to offer 3rd party website security services tailored for this market (the cost for hosting companies to keep repairing hacked sites is becoming a significant burden). At 6Scan our automated service is an advanced low-touch solution designed for small businesses and there are a few other options including SiteLock and Sucuri.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 7:05:13 AM
Re: What about solutions? >Early Trends in Hosting
I find it really interesting that web hosting companies are looking to offer 3rd party website security services tailored for the small biz market because of the increasing cost for them to repair hacked sites....  That's something to consider when choosing a web hosting vendor. 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:48:54 PM
Re: What about solutions? >Early Trends in Hosting
Exactly. The incremental premium for a hosting service that takes security seriously is negligible compared to the lost revenue/reputation if your company's website gets placed on the Google blacklist/blocklist.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
8/27/2014 | 9:38:51 AM
Re: What about solutions?
I'm surprised we don't see more small business solutions around Web Application Firewalls (WAF) or DDoS.  These are great ways to limit the risk of malicious traffic and can be offered as hosted solutions.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:37:11 PM
Re: What about solutions?
WAFs are a valuable layer in website security. Companies that don't have dedicated IT resources may want a "security suite" approach that includes vulnerability and malware scanning and remediation as well. On the DDoS side its not a particular concern for smaller businesses, the bigger threat for them is being hacked and co-opted into a botnet that will participate in the actual DDoS attack.
Biffster
50%
50%
Biffster,
User Rank: Apprentice
8/27/2014 | 9:48:17 AM
Automation
Nice article.  What I like about the author's company 6Scan, is their emphasis on automation to improve website safety and security.  It is a complicated world out there.  Thanks for making it a little simpler.  Imagine how effective the air bags in your car would be if you had to operate them manually.  Automation is the key, especially for small business sites.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:38:08 PM
Re: Automation
I like the analogy. I may borrow that one. Thanks!
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/27/2014 | 12:17:52 PM
Don't bother without security
This is why I feel like I'm stomping on people's ideas everytime a friend tells me they've come up with a clever business idea that involves a website. If they don't know how to handle security themselves and can't afford to hire someone to do it for them, it seems doomed to fail. 

When your reputationo can be ruined so easly, it's going to become much harder to startup internet based businesses, without some serious capital funding to help shore up defenses, preemptively and after the fact. 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:45:37 PM
Re: Don't bother without security
Unfortunately security is often the last thing to be addressed in a website launch plan (if it's addressed at all) and the more dynamic a site is, the greater the attack surface is likely to be. We're hoping to raise the awareness that big names make the big news (Target, etc) but the majority iof attacks target smaller businesses. The cost is also coming down so it should be attainable for almost all start-ups.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
8/28/2014 | 2:49:48 PM
Re: Don't bother without security
Unfortunate indeed! Delivery of secure technology, and not just delivery of technology itself, should be a top priority for a business that includes an internet presence as part of their operational and strategic goals. However, without proper communication of the importance of security, organization heads will not place that kind of priority on security. It is therefore imperative that security professionals learn the art of effective business communication if they are to push the security agenda forward. FUD (fear, uncertainty, doubt) based messages have gone the way of the boy who cried wolf. Tough sell though, for a small business that has limited resources to begin with.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/28/2014 | 3:12:31 PM
Re: Don't bother without security
Great point. With proactive security the cost/benefit analysis focuses on value of the assett being secured. Two examples we see are small companies that service larger customers and small businesses that run transactional models. 

If you serve larger clients (who interact with your site) the cost of being a watering hole -- hacked and infected as a means to attack your larger customers -- can be measured as percentage of the value of your current clients. Also, if the attack became public, competitors would use it to take new business. To stay competitive would then require  marketing to off set the damage. 

On the transactional side the calculation would include lost revenue if your site is blacklisted by browsers or toolbars (Chrome, Firefox, AVG, etc) and the near destruction of all SEO/SEM efforts. Years of optimization can be undone with a single malware detection and it can take months to get it back. 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/28/2014 | 3:15:27 PM
Re: Don't bother without security
A lot of the problems I've found when working with smaller businesses, is there's often a lack of understand not only of security itself, but who to hire to help with it. There are pleenty of freelancers I've worked with who claim to be well versed in Wordpress (or similar CMS) security, only to have them charge for hours of work with little results, or for them to clear out the affected files but not fix the loophole.

Very frustrating for everyone involved. I'd love to see some sort of accreditation that could be earned perhaps that was well known enough that even those unfamiliar with web security at an even basic level could understand and hire the right people. 
cherr552
50%
50%
cherr552,
User Rank: Apprentice
8/27/2014 | 8:02:34 PM
How do non-techie small businesses get security advice?
Many small businesses have a web presence, but no tech expertise--their web sites are developed by designers or consultants, who rarely return to maintain what they've built. 



In the setup-and-forget model, the site builders make recommendations about the hosting provider, and they should be able to recommend a security provider as well.  After all, their reputation depends on building sites that perform well (for their customers--the small businesses).
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 9:57:16 PM
Re: How do non-techie small businesses get security advice?
This rather common -- a small company has a problem with their site but the developer did it as a one-off project and is no longer actively engaged. You make a great point, when hiring a developer companies should ask for an ongoing plan to maintain the security of the site.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/28/2014 | 8:00:11 AM
Re: How do non-techie small businesses get security advice?
Or the web hoster should be more proactive about raising the awareness of the small business about potential website security issues that could cause serious damage.
Biffster
50%
50%
Biffster,
User Rank: Apprentice
8/28/2014 | 3:24:10 PM
Re: How do non-techie small businesses get security advice?
Agreed! Or perhaps Web Hosters should be more proactive in enforcing safe secure website behavior, sorta like the "click it or ticket" campaign for seat belt enforcement. Unsecured sites are the online equivalent of an attractive nuisance that can harm many others.
JosephL208
100%
0%
JosephL208,
User Rank: Apprentice
9/1/2014 | 9:28:53 AM
RE: Solutions
So, what are the solution? The real soutions? As a small business owner, I don't really have the time to dedicate to protecting my systems especailly given how fast the hacking evolves. Yet, I also can't afford to have my reputation and data compermised. So, what are the solutions?


Capital LookUp - www.capitallookup.com/
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
9/2/2014 | 6:37:08 PM
RE: Solutions
Hi Joseph -- at 6Scan we provide a free scanning service availble at www.6scan.com/signup. We will identify vulnerabilities and existing website infections and we provide paid remediation services to fix any problems. We try and keep the process as smooth and affordable as possible. Solutions are also available from SiteLock and Sucuri.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13616
PUBLISHED: 2020-05-26
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CVE-2020-13614
PUBLISHED: 2020-05-26
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
CVE-2020-13615
PUBLISHED: 2020-05-26
lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.
CVE-2020-9046
PUBLISHED: 2020-05-26
A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.
CVE-2020-12388
PUBLISHED: 2020-05-26
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.