Not a lot of companies are concerned about security when they are setting up a new site, migrating or revamping their existing website. However, security right now is a major concern regardless of your business size. Research has shown that around 41% of cyber attacks happen to small and medium enterprises (SMEs), which include network breaches, website code injection and more. Another concerning fact is that it takes an estimated 3-6 months to realise that your website has been compromised. Customer data, customer confidence in your brand would have been broken by then.
Why do hackers HACK websites?
Most hackers are looking for three things when they attack a website:
- Utilise your SMTP server. They use your relay server to send spam email to hundreds of emails every day. Until your hosting provider shuts down the relay server. Which means your day-to-day emails will be affected.
- Intercept your website traffic. They will redirect traffic going to your website into their own websites.
- Distribute Malware. They disguise installation prompts to install virus-infected executable files ‘flash player’ or ‘plug-in’ on visitor’s computers.
What you and your web service provider can do?
When you engage a web designer, ask more in terms of the security practices they have in place to see if you can be confident working with them in the long run. Some of the questions you can ask are:
Firewalls
Firewalls are software designed to monitor and filter activity before it reaches the web server. When configured, a set of rules is created and applied to all incoming and outgoing traffic in order to protect the systems and data. Ensure that the server hosting your website has a firewall in place.
Aside from firewalls provided by CPanel, SBWD will normally install and configure an additional firewall for added security to our client’s website.
Data Backup
When all else fails, with a proper data backup plan, you will still have a recent copy of your website and not risk to lose everything in the event that you are hacked. It’s ideal to find a company that has knowledge in backups.
For our maintenance packages, SBWD can put in place a weekly backup to a secure off-site server to be archived. We archive up to 1 year for clients under our maintenance. And we provide a same-day restore upon request by our clients.
Sandbox Development
Developing on a sandbox environment is to make changes on a mirrored version of your website. This way allows for thorough testing for bugs and vulnerabilities before releasing the latest website version onto the live server. Not a lot of web design companies work in this manner because it is time consuming.
However, we feel that such practices cannot be ignored and will always make it a point to work on a development server before migrating the codes to the live server. This minimizes the possibility of files being accessible to the public and also lesser backdoors for hijackers and bots.
Data encryption/ SSL
SSL certificates are a key part of eCommerce and actually a requirement by the Google Chrome Browser to have in order to be identified as a safe website to browser. a much larger part of safe browsing as a whole.
SSL provides a secure connection for data to be encrypted, especially sensitive information like consumer credit card data, personal contact information, proprietary files, and more. While SSL certificates aren’t required for most websites, Google’s Chrome browser has begun displaying messages that a site is not secure if the website includes any kind of form to submit data without a legitimate SSL certificate.
SBWD can assist in setting up SSL certificates for your website. We are adept at setting up various SSL certificates such as Digicert, OpenSSL, GoDaddy, Cpanel, RapidSSL etc.
DDoS and Content Delivery Networks
DDoS, or Distributed Denial of Service, is a method used to send an overwhelming volume of traffic/data to a website in the shortest span of time possible to crash the website or take it offline. This can be avoided by having a DDoS document where the server can monitor and filter traffic to detect whether a certain range of IP addresses are accessing your site too fast.
Content Delivery Networks (CDN) are set up around the world to cache your website content and offering a volume of benefits to website owners, including:
- Greatly improved page load times
- Reduced bandwidth consumptions thanks to improved load processing
- An additional layer of protection against DDoS attacks
SBWD has had experience with setting up Cloudflare, Amazon Cloudfront and Fastly to name a few CDN / DDoS 3rd-Party Applications.
Brute force detection
A brute force attack is a method hackers use in an effort to gain access to a server through an authentic login with legitimate access. Rather than try to locate vulnerabilities, the attackers will use automated software that runs through a massive number of consecutive guesses (username and password combinations) in an attempt to gain access.
As an added security blanket, we utilise applications or plugins that can be onto WordPress that limit the number of login attempts permitted. We are also able to modify your CMS login into an intranet, by enabling only certain IP addresses from logging into the backend system.
Conclusion
All websites whether simple or complex are vulnerable to hacks because hackers just want to utilise your emails, website traffic, website pop-ups to infect more sites. Having a hacked website looks extremely bad for your company.
SBWD understands that and offers a robust suite of security features in combination with proactive detection to mitigate risk, close vulnerabilities and protect your business website.
Contact us for website design/ revamp services or understanding more about our maintenance packages.
