Security and the web
◼ The lack of data security on the internet has become a
high-profile problem due to the increasing number of
applications oriented towards commerce.
◼ Many commercial applications require that the client &
server be able to authenticate each other & exchange
data confidentially.
◼ Several software companies & electronic marketplace
providers are tackling the issues of secure HTTP
implementations by developing additional data security
measures that involve encryption.
◼ Encrypted information can be “unlocked” only by the
intended recipient through a digital key.
•RSA (Rivest–Shamir–Adleman) is a public-key cryptographic algorithm used in
SSL to establish secure connections.
•SSL uses RSA during the handshake phase to:
•Authenticate the server (and optionally the client)
•Exchange keys securely
•Establish a shared secret for symmetric encryption
Categories of internet data & transactions :-
◼ Several categories of data must be encrypted, making
internet data security an interesting challenges:-
1. Public data have no security restrictions & can be
read by anyone.
2. Copyright data have content that is copyright but not
secret.
WWW – based security schemes:-
Several methods can provide security in the web
framework. These include the following:-
◼ Secure HTTP(S-HTTP) is a revision of HTTP that will
enable the incorporation of various cryptographic
message formats. Such as DSA(Digital Signature
Algorithm) & RSA(Ron Rivest, Adi Shamir and Leonard
Adleman) standards.
◼ Security socket layer (SSL) uses RSA(Rivest-
Shamir-Adleman) security to wrap
security information around TCP/IP- based
protocols.
◼ SHEN is a security scheme for the web sponsored by
the W3 association.
SSL
• SSL (Secure Sockets Layer) is a security protocol developed by Netscape in
1995 to protect data transmitted over the internet.
•It ensures privacy, authentication, and data integrity between web servers
and browsers.
• SSL has since evolved into TLS (Transport Layer Security), which is now the
standard for secure communications online.
SSL
•SSL operates through three key mechanisms:
• Encryption: Converts data into unreadable formats during
transmission, protecting it from eavesdropping.
•Authentication: Verifies the identity of the communicating parties
using SSL certificates.
•Data Integrity: Ensures that the data sent is not altered during
transit.
SSL
•SSL Certificates
•An SSL certificate is issued to a website to confirm its identity and
enable encrypted connections.
• These certificates are essential for e-commerce, banking, and any
site handling sensitive data.
SSL Handshake Using RSA
•Client Hello: The client sends supported cipher suites and its random
value.
•Server Hello: The server responds with its chosen cipher suite and
certificate (containing its RSA public key).
• Key Exchange: The client uses the server’s RSA public key to encrypt
a randomly generated session key.
•Session Established: Both parties use the session key for symmetric
encryption during the session.
What Is SHEN?
•SHEN stands for a Security Scheme for the World Wide Web.
• Designed to address the growing need for secure communication
and data exchange on the internet during its formative years.
• It was developed as part of early web security efforts and was
funded by the European Union and CERN, with support from the
World Wide Web Consortium (W3C).
Key Components of SHEN
• Specification: Detailed the ideas and implementation strategies for
securing web communications.
•While SHEN itself didn’t become a mainstream standard, it
contributed to the foundational thinking around web security and
helped inform later developments in secure HTTP and encryption
practices.
Hackers may hone in on your eCommerce site for a variety of reasons:
•To redirect your website visitors to another commercial site
•To hurt and take over your organic rankings (i.e., SEO spam)
•To steal your customers' information such as credit card details
•To install malware on your visitors' devices
•To hurt your brand’s reputation by vandalizing your website with offensive,
political, or other content that serves the hacker's agenda
•To hijack cookies and Session IDs to gain access to restricted areas
•To insert malicious code that allows the attacker to control your website
remotely (e.g., backdoors)
•To use your website to send spam emails
•To launch a distributed denial of service (DDoS) attack
Threats to your eCommerce website
Search query language (SQL) injections
•One of the most common attacks is known as SQL injection.
•This is where a hacker inserts malicious code into an input field on a
webpage to gain access to the underlying database.
•Once inside, they can extract sensitive data including customer credit card
details, passwords and other sensitive information.
Threats to your eCommerce website
Distributed denial of service (DDoS) attacks
A DDoS attack occurs when a hacker attempts to overload a server
with traffic.
• The goal is to take your website offline or otherwise interrupt
your website’s functionality.
• To do this, a bot sends large volumes of fake traffic to a website
to try to overload the server and cause a site crash.
• This is obviously very damaging for an online store since it
prevents customers from browsing, viewing or purchasing from
your website.
Threats to your eCommerce website
Ransomware
• Ransomware is a type of malware (e.g., malicious software
designed to cause damage) which encrypts a website's files.
• Once encrypted, the initiator of the attack demands a ransom
from the website owner to decrypt them.
• Until the ransom is paid, the website or system is. Ransomware
attacks can be costly and time-consuming unusable to fix
because they involve paying the hacker the “ransom” to restore
your data.
Threats to your eCommerce website
Cross-site scripting (XSS)
• Cross-site scripting involves injecting malicious javascript code
into a trusted site, like your online store.
• When an unsuspecting customer visits your page, the attacker
uses XSS to send a malicious script.
• This script will allow the attacker to view your customer’s
cookies, credentials (with which they could steal bank
information or credit card data), or rewrite an HTML page.
Threats to your eCommerce website
Credential reuse
• When a hacker uses stolen credentials (usually from another website) to gain
access to your website, it is known as credential reuse.
• This type of attack exploits the tendency for people to reuse the same
password on multiple websites and online services.
• An attacker may obtain a user’s credentials in a few different ways (e.g.,
phishing, data breaches, credential stuffing bots, password spraying, etc.).
• Once hackers have the user’s login information, they can use it to log into
other popular websites and thus do more damage.
Threats to your eCommerce website
Ecommerce payment fraud
• There are several ways attackers initiate eCommerce payment fraud.
• In one instance, the fraudster may use illegally obtained credit card numbers
to make a purchase on your site.
• In another instance, the fraudster may take over a customer’s account by
purchasing stolen passwords, implementing phishing schemes, or using other
unscrupulous means.
• Once in the account, the hacker may change account details and purchase
products from the user's online shopping cart.
• To mitigate these threats, it’s important to take steps to keep your website
and your customers’ data as safe as possible.
Ecommerce website security checklist
1. Choose your eCommerce platform wisely
2. Use HTTPS
3. Promote strong passwords
4. Do not hoard user data
5. Closely control admin rights
6. Create website backups
7. Practice good plugin hygiene
1. Choose your eCommerce platform wisely
1. Your website builder is your number one ally when it comes to website security.
Not only do the best eCommerce solutions offer a solid infrastructure but they’re
also backed by dedicated security experts.
2. For example, Wix eCommerce offers enterprise-grade security—fully managed for
you 24/7. During the development process, our team incorporates procedures like
threat modelling, code review, and penetration tests all aimed at preventing cyber
attacks.
3. Any Wix app partners undergo ongoing security assessments. And Wix itself
achieves the highest level of privacy and security compliance, allowing you to
accept secure online payments and maintain a highly-vetted network of vendors.
2. Use HTTPS
1. Secure Sockets Layer (SSL) is a type of encryption that helps to protect data as it's
transmitted over the internet. In other words, when a user enters his or her
payment information into your checkout page (as an example), an SSL-certified
site will encrypt the data as it’s being passed between browsers, making it more
difficult for hackers to intercept information.
2. Websites that are SSL-certified are displayed as “https” in the URL. This signals to
your buyers that the information they enter onto your website is being processed
securely. All Wix sites are served over HTTPS by default, giving you and your
customers peace of mind.
3. Promote strong passwords
1. It’s not uncommon for site visitors to reuse usernames and passwords, or to
simply get lazy with their passwords. If you offer loyalty programs or subscriptions
that require members to create an account on your site, make sure to stress the
importance of a strong password.
2. Require customers to create complex passwords. Provide examples and specific
criteria for a strong password (e.g., require a mix of letters, numbers, and
symbols—and discourage easy-to-guess words like "password").
3. Within your own team, make sure to create unique, complex passwords for any
accounts connected to your online store. This includes your hosting account,
domain registrar, and payment processors. Turn on 2-step verification from your
Wix account for optimal security.
4. Do not hoard user data
1. While it may be tempting to collect information on your users just in case you
might need it, you should only collect data that’s needed to complete a
transaction. This reduces the amount of sensitive data that you have on hand in
the event of a security breach.
2. Moreover, you should never store a customer’s credit card data on your servers,
with the exception of recurring payments. Storing credit card numbers is a big
liability and there is a lot of red tape to be aware of, as detailed by the Payment
Card Industry Data Security Standard.
3. Note: all Wix sites are compliant with the highest PCI standards (PCI DSS Level 1)
by default.
5. Closely control admin rights
1. As your business grows, your team will inevitably grow as well.
2. As more and more people get involved on your site, award admin rights to your
account sparingly. Avoid giving admin access to team members who may not
really need it lest you leave your site more vulnerable to attacks.
3. Consider writing a security policy for site admins to follow. This should outline
things like how to create a strong username, how to choose a strong password,
and how to detect phishing attempts.
4. Cybercriminals are getting more sophisticated every day, exploiting any
vulnerability they can find, including human anxiety. In 2020, Microsoft reported
that cybercriminals were using COVID-19-themed phishing to trick people into
giving up their personal information and credentials. Guard your team against
these types of attacks via thorough, regular training.
6. Create website backups
1. If a security breach occurs, you’ll want to make sure that your site is backed up so
that you can restore all of your data and site settings in their pure, untainted
forms.
2. Many website builders like Wix eCommerce will automatically create backups of
your site. If you’re not sure whether your site is backed up, check with your
website builder or site developer.
7. Practice good plugin hygiene
1. As a best practice, we recommend regularly auditing your third-party apps and
plugins. Check that you’re still using them and trust them with your store’s data.
Do not let plugins stack up unnecessarily, and limit the number of parties that can
access your site’s and customers’ data.
Popular E-Commerce sites