Each passing day brings with it news of a brand new leak of personal information over the Internet. Be it credit card information belonging to millions of users or their email IDs and passwords, personal nude pictures of celebrities or even top secret classified government data — the world of hackers has democratized the Internet and its lack of security at every possible level.
You might now be wondering what this has to do with your innocuous little blog or website that does not carry users’ credit card information or nude pictures of Scarlett Johnson.
Well, hackers can turn your nondescript website into a malicious spy bot in a matter of minutes, sending sensitive user data to hackers without your even realizing it. Worse, they can hack into your website databases and destroy or manipulate important information, injecting your content with malicious links and even hijack the hosting server to be used in bot net D Dos attacks.
But enough of this scare fest. It’s not all doom and gloom out there on the Web. There are things that you can do to secure your website from hackers and becoming a target for on-line vandals. Here’s a roundup of the easiest steps you can take:
Keep All Software Updated
Whether your website was built from scratch by your development team or you chose to create a DIY site on a third party turnkey platform, as a site owner it’s your job to ensure that every piece of software you run is up to date.
CMS providers like Word-press, Joomla and their ilk work round the clock trying to plug any holes in their systems and release regular patches and updates that make their software less vulnerable to attacks. Ensure that you run these updates and have the latest version supporting your site at any given point in time.
If your site uses third party plug-ins, keep track of their updates and ensure that these are updated on time as well. Often, many sites include plug-ins that fall into disuse over time. Clean out your website of any unused, old and non-updated plug-ins — they are sitting ducks for hackers to be used as a gateway to enter your site and wreak havoc on it.
Build Layers of Security Around Your Site
Just as you lock your doors before leaving your house and install anti-virus software on your desktop computer before browsing the web, you should also have a security system to serve as your website’s first line of defense against hacking attacks. A Web Application Firewall is that first line of defense. These solutions are designed to inspect incoming traffic, provide and weed out malicious requests –- offering protection from SPAM, brute force attacks, SQL Injections, Cross Site Scripting and other OW ASP Top 10 threats.
Until just a few years ago, Web Application Firewalls were only available as hardware appliances, but today a few Security-as-a-service (SECaaS) providers are revolutionizing the industry by using cloud technology to cut down prices of security solutions previously found only in enterprise level setups.
Consequently, all website owners can now “rent” a cloud-based Web Application Firewall, without committing to pricey security appliances or even owning a dedicated hosting server. Better yet, these plug-and-play services don’t require you to hire security experts or attempt to learn every aspect of web security. (Most of us just don’t have the time to become cybersecurity experts too.)
With hundreds of thousands of websites hacked every year, it’s becoming clear that hosting providers are not sufficiently equipped to handle all website security threats because frankly website security is not within their primary agenda. Now cloud-based Web Application Firewalls are filling that void.
Use Strong Passwords, Change Regularly
This one’s another no-brainier. Brute force attacks that try guessing user-name password combinations have multiplied at alarming rates over the last couple of years with thousands of attacks being detected on a daily basis across the web.
Using strong passwords is an effective way to limit if not completely eliminate brute force and dictionary attacks. Strong passwords are not just a requirement for your email or financial transactions on-line, they are also imperative for your website server, adman and database passwords.
Make sure your password is a combination of alphanumeric characters, symbols, upper and lower case characters and is at least 12 characters long to prevent brute force attacks.
Do not use the same password for all your different website logins. Change your passwords regularly to keep them doubly secure. Store users’ passwords in encrypted form. This ensures that even if there is a security breach, attackers do not get their hands on actual user passwords.
Make Ad-min Directories Tough to Spot
An ingenious way hackers gain access to your site’s data is by going straight to the source and hacking into your ad-min directories.
Hackers can use scripts that scan all the directories on your web server for giveaway names like ‘admin’ or ‘login’ etc. and focus their energies on entering these folders to compromise your website’s security. Most popular CMS’s allow you to rename your adman folders to any name of your choice. Pick innocuous sounding names for your adman folders that are known only to your web-masters to greatly reduce the possibility of a potential breach.
This is such a basic and easily avoidable hacking scenario, that it’s astonishing how millions of websites still ignore it.
Conclusion
Most of us go through life with the philosophy ‘It won’t happen to me’. However, that philosophy has been proven not t be true in the world of on-line
security. A successful attack on your site not only leads to compromising of users’ data and your own information, it can also lead to a blacklisting of your site by Google and other search providers as your infected site risks spreading malicious content throughout the web.
Erring on the side of caution works best in this area. Implement at least these basic steps right away, to avoid being a soft target for malicious hackers.
No comments:
Post a Comment