News & Insights

Too much to lose if you rest on your laurels!

We often hear about website hacks, login credentials or confidential information being stolen from sites. As the threat of data breaches and cyber invasions grows, the stakes are especially high for e-commerce businesses, given that their customers’ payment details are transmitted virtually during transactions.

While there is no foolproof way to guarantee your site will never get hacked, here are a number of proactive moves you can make to reduce the chances of falling victim to any sort of hacking activity:

1. Keep your software and patches updated

WordPress, Magento and Drupal Commerce are some of the platforms of choice for businesses, as they provide friendly, customisable template that are accessible even to users without technical backgrounds. However, these sites are still prone to software vulnerabilities, and e-commerce site owners should always do their due diligence by ensuring that software and patches are updated regularly, to prevent hackers from taking advantage of security flaws.

Another proactive action to enhance web security is the use of an advanced web application firewall, which serves to protect your website while updates are being carried out.

2. Create a custom Admin Path

Simply changing your Admin Path from the default address is another small but important step to deter hackers from targeting your site. This is because hackers may use automated tools to locate standard username/password configurations and later, test them on your site to gain admin access. Whether bots or guesswork is their weapon of choice, it is crucial that you fix the loophole and avoid such “brute force attacks” by changing to a unique admin page url.

3. Use a complex & unique password

Be creative and use a complex and unique password to access your website admin interface! This will significantly reduce the risk of your website being attacked by hackers. If you have difficulty recalling the various passwords used everyday, you can also leverage one of the many password managers available online.

4. Get an SSL certificate

SSL certificates are in essence digital certificates securing the connection between your browser and host server. They are what enable websites to move from HTTP to the more secure HTTPS. Using encryption algorithms, a binding connection is set up real quickly to ensure user data sent through the website stay secure.

To add, Google typically ranks HTTPS websites higher than HTTP websites, so the former performs better in Search Engine Optimisation (SEO) rankings and marketing! Having an SSL certificate for your website is a surefire way to help you gain user trust.

Look out for a URL starting with https:// and a padlock icon in the address bar.

5. File change monitoring

One critical must-do is to monitor the changes taking place on your website daily, as any unauthorised change might signal attacker activity.

6. Malware

Malware stands for “MALicious softWARE” – a term for all sorts of software used for criminal activity, including keyloggers which record the username and password entered during sign-in, or malicious JavaScript sent stealthily through the third-party shopping cart, which captures users’ credit card details during the check-out

Instead of unwittingly providing a back door for attackers, nip the issue in the bud through daily checks using a reliable malware detection solution.

7. Manage your users

Actively manage your users to safeguard against compromised accounts, such as knowing each user clearly and assigning the appropriate permissions level to each of them.

You would also want to monitor the site for unusual activity and tell-tale signs of account compromise. This helps guard against ‘insider’ threats, where employees use their privileged controls to access and steal data and disrupt operations.

8. Monitor site activity and conduct site security audits

Monitor your website closely for suspicious activity such as a far-flung physical location, or inconsistent shipping and billing address. Keep a log of all activity on your website, review and analyse this data, preferably daily, to identify threats and be alerted in near-real-time.

If your website enables credit/debit card transactions, you would want to record the security data log for at least a year.

9. Test and test again

Two primary approaches for security testing include:

• Vulnerability scanning – an automated tool of sending traffic, queries and specific requests to the website to detect for infrastructure layer or other system weaknesses that may be exploited
• Penetration testing – also known as ethical hacking, this is a simulated cyber attack carried out to probe for system weaknesses that might be exploited. This controlled hacking will mimic hackers’ tactics without causing damage, to suss out hardware/software flaws, and even operational weaknesses, that can then be promptly addressed

10. Choose the right website security partner you can rely on

Security is a continuous process. Choosing the right partner with extensive and in-depth service will assure your customers of their website security and give them better peace-of-mind to undertake transactions requiring credit card details on your site.

Conversely, turning a blind eye means you run the risk of compromising customers’ sensitive data, breaching their trust in your website and jeopardising your brand name and reputation, in addition to a loss of revenue. Just imagine if your webstore gets hacked, or if your customers’ data gets stolen or worse, sold or transacted on the dark web.

Safeguard Your Online Business (the time is now!)

At 2ez Asia, we have over a decade’s experience in website development and management, helping a spectrum of clients strengthen their website infrastructure and protecting their mission-critical web stores against vulnerabilities. Our specialised I.T. professionals have the trained eye and employ the use of analytics tools to look out for red flags and pre-empt or identify possible cybercrime activity at the earliest time.

Don’t lose sleep over your website security. Set the right wheels in motion by chatting with us over a phone call or dropping us a message right here!