Mediaboss Marketing

by Ilia Kolochenko - CEO at High-Tech Bridge SA - Monday, 6 January 2014.

As this article is mainly written for small e-business owners, I will omit technical details about web hacking techniques, and will focus instead on the general security mistakes that lead to vulnerabilities, which are then exploited by hackers.

One of the oldest and simplest problems is default or weak passwords used to access admin interfaces of web applications. Another related and very widespread problem is default admin panel location, such as /wp-admin/ or /administrator/ which facilitate a lot hacking of your website even with one simple XSS vulnerability. Password reuse is also a very common and dangerous practice. Avoid default admin panel location, and select strong and unique passwords so that these risks are avoided.

Another very common problem is old and outdated software. Make sure that if you are using an open source CMS such as Joomla, WordPress or osCommerce its up to date as well as all of its modules and plugins. Today, the biggest danger comes from numerous plugins that usually have plenty of vulnerabilities.

Another important point to mention is proper access control. Dont share your passwords and other credentials with people who do not necessary need to have them, otherwise once they are compromised your website will follow. It is always better to limit access to your admin panels from specific IP addresses or at least from sub-networks (in case you dont have a fixed IP). Make sure that, on your web server, file permissions are correct and other users (if any) cannot read your files.

Needless to say, the security of any web hosting service where your website is located is also important. Dont try to save money on it, as such economy may ruin your business. When selecting your hosting company, pay attention to what the companys reputation is, the client support it offers (it should have a competent security team ready to react rapidly on security incidents) and if it has a daily backup plan.

More here:
The growing hacking threat to e-commerce websites, part 2