EdwardKhoo.com

Image via

Website hacking has been around ever since w3 were introduced to the public in the 80s. While there may have been a time, at least in the early days, where hacking was rather simplistic and was comprised of little more than getting someone’s password and creating virtual “Graffiti” on their site, today’s hackers are much more sophisticated. More advanced techniques were introduced, which are dangerous and unpredictable, of course.

It’s important, first of all, to understand some statistics about website hacking. Around two thirds of website hacking is done not for ideological purposes or even graffiti, but rather for profit. People hack websites today in order to gather information they intend to use for nefarious purposes and for their own financial gain.

Strangely enough, then, just under half of all website hacking incidents occurred with non-commercial sites like governmental or educational sites. This may be, at least partially, because these types of organizations are more likely to report a website hacking attack, although that is not always the case.

When it comes to commercial sites, Internet-related companies tend to be top targets. This includes e-commerce sites, media sites, search engines, and even search providers. Part of the reason these companies are such a huge target is the fact that they often have databases full of all sorts of personal information that can generate billions of profits.

Issues

There are few issues when it comes to hacking; here we have highlighted some of those which provoked the hackers to do so:

1. The biggest issue when it comes to website hacking is the issue of personal information. Some websites store a large amount of personal data, from name and address information to credit card information and probably purchase history on the site. A website hacker can use this kind of information to steal the identity of the customers.

2. National security is another concern when it comes to website hacking. Some statistics suggest that as many as two thirds of hacking attempts aimed at the U.S. Department of Defense each year are successful. If this statistic is true, website hacking poses a very real and present danger, not only in the U.S. but in countries around the globe. Website hacking, then, is not only an issue of financial concern for some companies and for some individuals, but of safety and security of people around the globe.

3. Another important issue in this area is the source of website hacking. While outside attacks do make up a good percentage of website hacking incidents, many incidents are also caused from within. Whether it’s a disgruntled employee, an employee who is out for her own financial gain or a person who has been unwittingly recruited by a third party, a company’s personnel are at least an equal risk as those outside the company when it comes to website hacking.

4. Complicating the issue is the public image of the hacker. The stereotypical hacker is a computer geek who sits at home and breaks into secure websites just for fun. Unfortunately, this public image rarely matches the reality. Like we said before, most website hacking incidents aren’t about curiosity; they’re a dedicated effort to make money. Website hackers generally aren’t young kids experimenting – they’re often individuals with criminal purposes. It’s easy to commit crime and just escape using the internet. In most cases, they’re not acting as a “robin hood” of sorts, either. They are out to benefit themselves, and only themselves.

Above all, it’s worth mentioning that website hacking is illegal, regardless of who does it and for what purpose. Penalties can be severe, often very severe, for people who are caught website hacking.

Prevention

Preventing website hacking can be a challenge, especially if your company or organization doesn’t have expendable resources that can be invested in specialized security equipment or staff. Still, there are some important things you can do to prevent website hacking, or at least minimize your risk.

1. A company mush train their employees well when it comes to hacking. This occurs on two levels. Firstly, a company must let its employees know that hacking their website will be dealt harshly. If a company is willing to press charges against a hacking employee, say so. This may prevent an employee who is thinking about website hacking from ever doing it in the first place. Obviously, this doesn’t protect against outside threats, but it may help reduce the risk of internal threats.

2. The other type of training a company needs has to do with their IT department. Yes, your IT security engineer needs to be up to speed on the latest security techniques. However, your website programmers need to have a solid base of security knowledge, as well. There are some instances in which simply configuring a website a certain way can reduce the risks of website hacking, and your team needs to know how.

3. It’s also important that you keep your website scripts up to date. Use the latest and most stable version of the web software you’re using, so that potential security holes are closed. While new holes are often discovered, staying up to date helps reduce the number of potential successful website hacking scenarios. The same holds true for the operating system running on your web server, as well as any firmware running on your network equipment or your firewall and content filter.

4. Physical security of your systems is important, as well. It’s a lot easier for someone to walk up to your web server and make hacking changes than it is for them to invent some sort of SQL injection that will make those changes. Physical access to your servers and to systems that have access to your servers is key.

5. How you configure your website applications and permissions are key in preventing website hacking, as well. For example, if you use MySQL, set your usernames and passwords up in a way that you don’t allow maximum global permission to scripted users. Making sure your user groups have exactly the right permissions not only helps to grant users the tools they need, it also helps to reduce the risk of website hacking.

6. As with just about any type of computer security, it’s important to use strong passwords for administrative accounts. You should make sure those passwords are changed at regular intervals, as well. A well-developed password policy that is enforced systematically greatly reduces a number of IT security risks.

7. Keeping a strong firewall system in place is important in preventing website hacking, too. If you can use a filtering system that has access to a blacklist of potential hacking sources, you can reduce some of your website hacking risk. In addition, firewalls protect other systems that may be vulnerable to hacking or to other attacks.

None of these prevention methods are foolproof, of course. However, if you are diligent about them and able to implement them, you will greatly reduce the risk that a hacker will be able to attack your company’s website.

Tagged as: Hacking, Issues, Prevention, Websites