As a business owner, you’re constantly thinking about how best to protect and propel your company. But there’s one component that you may have overlooked: website security. Security breaches are inevitable, yet cybersecurity is often neglected. We’ve rounded three simple steps to make sure you’re covered:
Category: Small Business Page 5 of 9
Consumers have endless choices of where to shop this holiday season and your store – whether brick & mortar or online— must stand out. A well-designed, easy to use website is critical in cutting through the clutter to attract holiday shoppers and drive them to make a purchase. However, it’s important note that the same features you use to improve your user experience and retain customers can also leave your website vulnerable to a cyberattack and pose a significant threat to your business. Learn what we mean by this…
As more consumers shift to online shopping this holiday season, they expect their information to be protected every time they make a purchase. With just weeks left until the holiday season kicks off, now is the time to review your current website security strategy. It is important to ensure you’re well equipped to protect your customers’ data when cyber criminals attack.
Viruses used to be the only website security issue that companies worried about. With cyberthreats increasing in variety, protecting your website is no longer about installing a basic firewall. You also need to consider the necessary add-ons in all the right places to develop a multi-layered security plan.
Add-Ons That Help Website Security
To help you start your own deployment, below are three non-firewall add-ons that you should have in order to develop a comprehensive website security plan.
Remember the days when you could stop to make your morning coffee while waiting for a website to load? How about the times you wondered if your Internet was down because a picture took more than a few minutes to render? In the time it’s taken you to read this beautifully crafted intro, some websites will have lost precious traffic because their load time was over four seconds. Customers will wait — at most — 15 seconds, then leave your site and never come back. This may not seem like a big deal, but it has fiscal impacts on businesses of all sizes. Research by Kissmetrics revealed that even one second page delay could potentially cost businesses $2.5 million in sales every year.
If you accept credit card payments, you’re likely familiar with PCI compliance and what it entails. If you accept credit card payments, or are considering it, and are NOT familiar with PCI compliance, be sure to take accurate notes on the information that follows.
PCI DSS Overview
Created in 2004 by the five global payment brands — Visa, Mastercard, American Express, Discover and JCB — the Payment Card Industry Data Security Standard (PCI DSS) is a security compliance requirement for businesses that handle credit cards. It was created to protect customer and cardholder data from cyber attacks and fraud.
There are over 1 million new strains of malware created every day. One identified infection can get your website blacklisted by Google, who currently blacklists over 10,000 websites each day. Mind you, the malware need not even be on your site.
SMEs (Small to medium-sized enterprises) are unfortunately one of the largest targets of cyber attacks. On average, over 30,000 SME websites are targeted each day, and to make matters worse, nearly 60% of their IT professionals think they aren’t at any real risk of being attacked.
Don’t allow your business to suffer expensive cyber attack damages (which average around $50K per attack) — instead, be proactive in your web security efforts to prevent security threats, protecting you and your customer’s private data. Here are 5 tips to help you protect your website from malware and other cyber threats:
1. Updates and Patches
Is your website running off of a Content Management System (CMS) such as WordPress? A CMS can be an easy and cost-effective way to manage your business’ website, but they’re also large targets for cyber attacks.
Why? Many CMS platforms and plugins are often easy targets for hackers and allow backdoor access to your server and data (a recent example of this vulnerability was the SoakSoak attack that occurred last month). Make sure your system, plugins and themes are always up to date, strengthening your web security. Many CMS solutions will even automatically update files for you, if you choose.
2. Website Scanning
Many web viruses and other malware go unnoticed until it’s too late, due to their elusive nature. They can often be implemented with a simple one-line script, injected into the code of your website – made to look like normal code.
Website security scanning software can scan your website for existing malware and other harmful code that doesn’t belong, and notify you immediately of any threats. Our SMART (Secure Malware Alert & Removal Tool) software takes it a step further by automatically removing anything harmful – similar to what a virus removal software does for your PC.
3. Web Application Firewalls
Removing existing website threats is one issue, but keeping them from coming back is another. With over 1 million new malware strains created each week, your business’s website can potentially to be infected by a new virus every day.
Web Application Firewalls (WAF) can help prevent attackers from even visiting your site. How do they work? Let’s take our TrueShield WAF, for instance – it evaluates traffic based on where it’s coming from, how it’s behaving, and what information it’s requesting. Based on these and other criteria, the firewall will allow “legitimate” traffic (e.g. customers and search engines) access while blocking “malicious” traffic (e.g. spam bots and hackers).
Used in conjunction with a website scanning solution, a WAF can help provide around-the-clock, hands-free security for your business’s website.
4. PCI Compliance
The Payment Card Industry Data Security Standard (PCI DSS), or PCI for short, is a security standard that businesses must adhere to if they accept major credit cards. This compliance helps ensure that your business and customers are protected from cyber attacks and fraud by providing a documented, baseline security posture for your site. Failure to comply with PCI standards can result in direct financial damages, lawsuits, government fines and ultimately ruin brand reputation in the event of a data breach.
Fortunately, it’s not difficult to become PCI compliant. There are many solutions that walk you through the steps to help create your own customized PCI policy. Our SiteLock® PCI Compliance program takes it even a step further by scanning your site and network, and you can also add on our PCI-certified TrueShield firewall.
5. Strengthen Passwords
Even now the world is still using weak passwords. A strong password is one that contains over 8 characters, no dictionary words, has a mixture of uppercase and lowercase letters, and includes digits and/or special characters. Unfortunately, many of those boxes aren’t checked – allowing brute-force hacking techniques (repeated attempts to login to your website) to become effective.
It’s extremely important that you create a strong password for your website’s back end, since it can often times be an easy way into your private data. You should also advise your customers who have online accounts to do the same, to help protect them from future attacks. After all, it only takes seconds for a computer to crack a poorly created password.
Want to stay up to date on the latest malware trends and ways to protect against them? Follow SiteLock on Twitter!
If you think that DDoS attacks are just a problem for the big guys, a new study might change your mind. The recently published DDoS Impact Survey found that nearly one in every two companies, regardless of size, were victims of a Distributed Denial of Service attack. The average cost of a DDoS attack ran to around $40,000 for every hour the attack lasted
The authors of the survey spoke to nearly 300 North American companies, ranging in size from 250 employees to more than 10,000. The responses were very troubling:
It’s bad enough to get a bunch of calls from irate suppliers wondering why you haven’t paid bills that are months overdue. But it’s even worse if you have no idea what they’re talking about. That’s how one small business owner found out what it was like to have his entire business hacked and cloned by people he never met and never caught.
So you’re thinking about finally launching your first website. Or you’ve had a website up and running for years but it’s time for an upgrade, an overhaul, and brand new chapter in your online presence.
You’ll have plenty of things to think about and to get right, so just make sure you don’t leave security as an afterthought.