Website Security and Startups

You know that it really matters when statistics show that there are more than one billion people buying online. In fact, that number is growing with internet and smartphone penetration across the globe. It has been estimated that the growth resonates across both B2B and B2C markets, opening gates for huge opportunities across sectors. Here are some of the website security figures to back it up.

As far as the global figures are concerned, there is not even a shred of doubt that online businesses and transaction facilities will grow magnanimously with;

• E-commerce sales will touch $440 billion in the US alone by 2017.
• There are more than 1 trillion websites.
• There are more than 3.17 billion internet users.

It’s evident that consumers have sunk their teeth deep into the habit of ordering whatever they like, from wherever they like, at competitive prices. Leave them, isn’t it a heaven for every seller too? No more monopolies or psychical presence restrictions. It’s an opportunity that almost everyone who has something to sell can utilize. And it’s happening big time. Amazon, a company that was founded in a garage, commands a net worth of $29.9 billion today.

Now fathom this, according to Statista, people pay around $235.4 billion just through mobile devices. The figure is monstrous for overall internet transactions. Now that important question is that with customers having such huge credit and debit card purchase power, are global businesses really prepared to process such transactions securely? Can they really overlook PCI and other regulatory compliance with rising man-in-middle attacks?

Shouldn’t it be the first step to making people comfortable with sharing card info online, and of course to prevent exploitation? Unfortunately, many organizations know little about it.

We understand that website security can often be daunting. What are the matters that you should really look into? Why is there a new kind of threat in every few weeks? How can one monitor threats?

Fortunately, it’s not that difficult to get hold of things, if you are really up for it. Here’s what you can do in the next half an hour to lay a secure foundation.

Success brings many foes. Last year, eBay’s stock fell more than 8 percent after it was reported that data for 145 million customers was compromised. Obviously, no organization is immune to such threats.

Current Online Threats that horrify the e-retailers:

• Defacement of websites leading to blacklisting
• Loopholes in web application security providing attackers access to sensitive and confidential data
• Malware / Spam ware aiding attackers in capturing data for misuse and to gain access to visitor information and online behavior
• Malware installing itself into a computer to stealing data without knowledge

Automated application scanning combined with manual penetration testing to look for logic flaws in coding and app vulnerability helps provide a detailed report with evidence of exploits with steps of attacks.

Mobile App Security- Secure the Future

Mobile applications are often more insecure. In fact, with frequent updates, companies rarely get time to test for data breach weaknesses. Surprisingly, most of such vulnerabilities are the ones listed by OWASP in Mobile Top 10 Vulnerabilities. The figures are critical especially when mobile apps are seen as the future of technology.

• Snapdeal expects 90% of its orders from consumers who buy through mobile devices in the next two years.
• Around 70% of the orders on eBay and come from tablets and smartphones.

OWASP maintains that mobile apps are as vulnerable as web apps. Often mobile malware, unsafe app capabilities, hidden processes, and complex code vulnerabilities cause applications to crash or share data with third parties. With constant updates, the problem only gets worse.

Such issues can only be dealt with real-time mobile application penetration testing for malware detection, log analysis, Layer 7 assessment, and more.

Task: Find out how mobile application security penetration testing works here.

Often recognized by a padlock in the URL bar, Secure Sockets Layer ensures that the communication between web browsers and servers is encrypted. It’s good to prevent eavesdropping over the internet. However, it’s not a panacea to every kind of threat.

Most online retailers advertise that their websites are secure as they use 128 or 256-bit encryption and they might even display a seal from an external certificate authority confirming that their site is secure, but they fail to understand that SSL cannot protect against application-layer attacks.

Task: Review website security if it’s solely based on an SSL certificate.

More than 75% of attacks occur at the web application layer. Now, web applications are complex in nature and have to be changed frequently. As a result, they are ridden with vulnerabilities that serve as entry points for hackers to infiltrate the applications.

Last year in December a Cross-Site Scripting (XSS) vulnerability was discovered in AliExpress from Alibaba Marketplace that allowed an attacker to hijack merchant account, leading to phishing or data breach possibilities. It can happen to any site without knowing about the threat for months.

In fact, estimates show that in India it takes over 100 days to fix vulnerabilities after detecting them. In addition, there are stringent compliance requirements, e.g. by PCI DSS and IT Act 2000, requiring enterprises to ensure maximum security for their web applications. What’s the solution?

In such a scenario, the Web Application Firewall is the only way to virtually patch vulnerabilities like XSS and others. It acts as a shield that prevents exploitations without obstructing normal traffic or online business operations.

Additionally, WAF also needs to provide smarter business solutions with zero WAF false positives and continuous monitoring with adaptation for any changes to the application.

Task: Know how a web application firewall works

Online businesses will get bigger than ever. More players will join the bandwagon, there will be mergers, and there will be acquisitions and takeovers. Intense competition will turn on the heat and will lead to aggressive marketing and sales efforts backed by the rapid development of sophisticated web applications. However, in the middle of key business activities, security should not struggle. If web application security technology is not exactly your stronger suit, there is always an option to offload these worries to a trusted website security partner. It’s all about understanding the complexities and strategizing a strong 360-degree application security plan around the ‘Detect, Protect & Monitor’ concept.

Task: Explore the AppTrana concept for your business.