Website Hacking a Big Danger

In a surprising statistic, Google quarantines approximately 10,000 websites a day via its Safe Browsing Technology and over 30,000 new websites are identified each day distributing malicious code to users.  Of the millions of websites that push through the scanning technology, we often see a lot of them to have some Indicator of Compromise that denotes a hack.

All websites, including blogs, small business up to and including large fortune 500 corporations, stand at risk of being hacked at one point or another.  It is very important to acknowledge that security glitches do exist that could place your website at risk.

The attacks that could affect the security of your website may be attacks of opportunity or targeted attacks.

The composition of websites and how they are hacked have not really developed as much as some may assume. The structure may have become more complex, but the hacking remains similar.  Websites can be hacked due to certain features, to include but not limited to:

• Website and Administrative Controls
• Software Vulnerabilities
• Integrations and vulnerabilities of third-party software

 The Structures of a Website

These are details that website owners never really consider, especially if they rely on web developers.  However, there are different factors that make up a website in order for them to function properly.  These factors are Domain Name System/Server (DNS), the server that hosts the various websites, and the infrastructure where the servers are located.

Each factor must work in harmony with each other in order to provide the customers with a functional website.  Unfortunately, each element can also influence the effect of security and potentially contribute to how your website may become compromised.

How Websites Get Hacked

As mentioned above, all websites, regardless of business size, stand at risk of being hacked.   It all originates from the same fundamentals.  The biggest question and disputes among website owners and possibly website administrators is “Why”.

It is no secret that a lot of small businesses prefer to keep and maintain their own website for various reasons.  In doing so, it never occurs to them that their website could ever be hacked.  When it comes to small businesses, the approach is often similar – “I’m not going to get hacked.” – “Why would anyone want to hack me? I don’t have credit card information”. –  “There’s nothing valuable”.

There is no such thing as “too small to hack”.  If your business has a website, it is subject to risk of hacking and hackers can access your website and exploit it.  Stealing personally identifiable information from users and visitors is one way they derive value. But even without credit card or bank information, user/password credentials can be valuable when used as part of a bigger scam, including but not limited to hosting malicious content used in phishing scams.

In 2013, websites such as Facebook, Twitter, Microsoft, and Apple were compromised in “watering hole” attacks (initiating an attack against targeted businesses and organizations. In a watering hole attack scenario, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection).  Small businesses relying on “security through obscurity” are gone.  With the continuous advancement in technology and the increasing sophistication, hackers have extraordinary incentives to unleash attacks on even the smallest sites.  Small business need to begin to regard their website security as a necessary part of online presence. 

You must realize and remember.  If or when your website gets hacked, whether business or personal, it is not just your website or business at risk, but also your reputation.  Although, you may get blacklisted by Google and other search engines, those will pale in comparison to being used as a platform to attack your business partners, vendors, customers, friends and families.

Protecting Your Website

One of the best solutions for battling security issues is to understand the concept and be aware that they exist as a real threat to all websites.  It is often only after someone experiences the agony of a compromise that they begin to realize the critical consequences.  Unfortunately, at that point, it becomes too late.

Website security is about risk reduction, not risk elimination. There is no such thing as 100% safe and secure.  Almost all the tools you employ within your environment aim to reduce your overall risk posture, whether it’s continuous scanning or a more proactive approach such as mitigating incoming attacks.

Below are some helpful tips to consider:

1. Defense in Depth (also known as Castle Approach) – This concept applies multiple layers of security controls placed throughout an IT System.
2. Apply privileged access to the website
3. Website Firewall that focuses on both known and unknown intrusions.
4. Backups – backups of your website are your best safety nets. If your website ever gets hacked, you can use your backups to easily restore a clean copy of your website.  Without backups, you may have to re-create your website from scratch.

You should monitor your site regularly and be proactive in its security.  Realizing that security of your website is a necessity and not a luxury is your first step in protecting your website.  It is also not a one-time event, rather an ongoing process that must be maintained

References

1. Information Week – Top 5 Reasons Your Small Business Website is Under Attack
2. Search Console Help: “Security errors, explained”
3. Sucuri: “Why Websites Get Hacked”
4. USA Today: “Hacking a big danger for small businesses”
5. Localedge: How not to get hacked (and What to do if you do)