Website Security Briefing for Warriors
Hi Warriors,
I have read a few threads on the forum recently regarding websites that had been attacked. In particular there was a recent thread about a Warrior who found their blog had been hacked, templates had been changed and malware (viruses) had been embedded into their site.
I've written up these notes below in the hope that I can raise awareness of website security.
Security needs to be taken seriously. You should think about securing your website just as an offline business has to secure its business premises. It's not just malicious users and online criminals to be aware of, but also the "script-kiddies" who just see bypassing the security of website as a game or challenge.
A breach of security can have many effects, including loss of business, damage to your online reputation or brand, financial loss, costs in handling the incident, and legal liability.
I recently gave a presentation about basic online security, and these are the five topics I covered. There are some questions at the end you can use to evaluate your online security.
1. Password Strength and Secure Password Handling
The first step to protecting yourself is selecting a strong password. This means using something that can not be guessed easily. So avoid common passwords, and words that are in the dictionary. Use a password that has a combination of letters, numbers and punctuation. Make sure your password has more than 8 characters.
Passwords should always be stored in an encrypted format. Be wary of websites that have a facility to send you a password reminder, as this means they are storing the password in a clear and readable format. Secure websites store your password in a format called a "password hash" so no one can ever read your password. Rather than a password reminder, these websites will have a system to reset your password to something random, or send a one-time login link to your email address.
Hackers may use computer programs or scripts (called bots) to automate password testing. On a single computer a password hash from an 8 character password would take 16 minutes to crack. Obviously this is slower over the Internet. A cracker may use a "botnet" (network of multiple computers) to increase their capacity, but there are things a website owner can do to make things more difficult. These include limiting the number of login attempts allowed within a specified time period, or adding some further verification such as a CAPTCHA to ensure all login attempts are by human visitors.
Q: Are you using a strong password?
Q: Is your website login system secure?
2. Session Hijacking and User Input
Once you have logged into a website the server remembers who you are so you don't have to login to every single page. You usually login once for a specified period of time. Usually the server remembers you by storing a cookie on your computer that contains a "session ID". This is an identifier that your computer sends to the server with every page request during this session. The server checks this to make sure you logged in.
What if another website could steal your cookies? If someone could get a hold of your session ID while you were logged in, they could potentially get into your account without even knowing your password!
Luckily, your browser will only send the cookie (containing the session ID) back to the website that it came from so you don't have to worry too much about other websites stealing your cookies. However, if your website includes user input (such as a forum or blog comments) then you need to check it very carefully for what are known as Cross Site Scripting (XSS) attacks. This is when an attacker submits content to your site to inject code into your webpages which is then viewed by other users. Since 2007 XSS attacks have accounted for 80% of reported website attacks.
Another concern with user input is that most websites today have some kind of database back-end. When you store user input into a database it must be carefully checked to ensure that it contains no malicious code that can interfere with operation of the database system. If user input is not properly checked before it is sent to the database then there is a chance a malicious user could retrieve secret information or corrupt your data.
Q: Is all user generated content rigorously checked and filtered before it is displayed on your website?
Q: Is all user input on your website filtered before being stored in a database?
3. Keep Up-to-date
New versions of software are released all the time. Open-source software is particularly good at finding and fixing security vulnerabilities because they usually have many more people involved in the development process than proprietary software. This is a major advantage only as long as you keep up-to-date with the latest software versions. Known vulnerabilities can often be exploited by malicious users so as soon as updates are available you should make sure you install them.
If you use a Content Management System, or blog software for example, and if you do not keep up-to-date then you leave yourself open to attack. If someone can work out what version you are using they can find out what vulnerabilities are available to exploit. We have seen stories of this on the forum here. Blogs getting defaced, or malware and viruses being embedded into pages without the owner's knowledge.
Q: Is your website running the most recent version of your CMS, templates, plugins, etc?
Q: Is your server running the most recent software?
4. Multiple Users = Multiple Accounts
Main administrator (root) login details should be kept highly secure. You should create separate accounts for people where possible and give them only the permissions they require to do particular tasks they need. It's a good idea to avoid using the main administrator account for your own daily website maintenance and use a separate account, reserving the main admin account for only occasions that require full server access.
When you change staff/moderators/outsource workers or suppliers you can remove accounts and setup new ones. I'm not suggesting that you don't trust the people you work with, but if you have accounts restricted to just the access they require then if an account gets compromised an attacker is limited in the amount of damage they can cause.
Q: Do you use separate accounts for all users?
Q: Do all your users only have access to the parts of the system they need?
5. Backups
Your site is probably made up of a combination of program code, configuration data, and content database. It is important to have a backup in-case you need to recover from hardware or software failure, but your backup routine is also an important factor in your security planning.
Most professional development teams will have program code and configuration data under version control. This stores a new version every time the code is changed. If a developer makes a change that either breaks something, or a designer makes a tweak to the layout that people don't like, you can restore a previous version of the code from any point in time. Because it is possible to compare different versions of the code you can see what has changed, which can be useful if your website security is compromised as you can discover what changes have been made by the malicious user by comparing to previous versions.
Content is usually stored in a database, and it's important to make regular backups (called "database snapshots") of your content. It depends on how frequently your data changes, and how much you can afford to lose. On a popular site where content is constantly submitted you will want to take a snapshot at least every hour. On a site that has less frequent updates you may want to do nightly snapshots. These backups can usually be automated in your server configuration tools.
Q: Do you have enough backups to easily restore the site to any point in time?
Q: If your server was completely destroyed today, how quickly could you be up and running again on a new system?
Summary
To recap:
Q: Are you using strong passwords?
Q: Is your website login system secure?
Q: Is all user generated content rigorously checked and filtered before it is displayed on your website?
Q: Is all user input on your website filtered before being stored in a database?
Q: Is your website running the most recent version of your CMS, templates, plugins, etc?
Q: Is your server running the most recent software?
Q: Do you use separate accounts for all users?
Q: Do all your users only have access to the parts of the system they need?
Q: Do you have enough backups to easily restore the site to any point in time?
Q: If your server was completely destroyed today, how would your business cope? how quickly could you be up and running again on a new system?
I hope you found this an interesting read. I don't mean to cause alarm unnecessarily, but if it helps just one person protect themselves against losing anything to hackers then it was worth posting. Thanks for reading.
Any Questions?
I have read a few threads on the forum recently regarding websites that had been attacked. In particular there was a recent thread about a Warrior who found their blog had been hacked, templates had been changed and malware (viruses) had been embedded into their site.
I've written up these notes below in the hope that I can raise awareness of website security.
Security needs to be taken seriously. You should think about securing your website just as an offline business has to secure its business premises. It's not just malicious users and online criminals to be aware of, but also the "script-kiddies" who just see bypassing the security of website as a game or challenge.
A breach of security can have many effects, including loss of business, damage to your online reputation or brand, financial loss, costs in handling the incident, and legal liability.
I recently gave a presentation about basic online security, and these are the five topics I covered. There are some questions at the end you can use to evaluate your online security.
1. Password Strength and Secure Password Handling
The first step to protecting yourself is selecting a strong password. This means using something that can not be guessed easily. So avoid common passwords, and words that are in the dictionary. Use a password that has a combination of letters, numbers and punctuation. Make sure your password has more than 8 characters.
Passwords should always be stored in an encrypted format. Be wary of websites that have a facility to send you a password reminder, as this means they are storing the password in a clear and readable format. Secure websites store your password in a format called a "password hash" so no one can ever read your password. Rather than a password reminder, these websites will have a system to reset your password to something random, or send a one-time login link to your email address.
Hackers may use computer programs or scripts (called bots) to automate password testing. On a single computer a password hash from an 8 character password would take 16 minutes to crack. Obviously this is slower over the Internet. A cracker may use a "botnet" (network of multiple computers) to increase their capacity, but there are things a website owner can do to make things more difficult. These include limiting the number of login attempts allowed within a specified time period, or adding some further verification such as a CAPTCHA to ensure all login attempts are by human visitors.
Q: Are you using a strong password?
Q: Is your website login system secure?
2. Session Hijacking and User Input
Once you have logged into a website the server remembers who you are so you don't have to login to every single page. You usually login once for a specified period of time. Usually the server remembers you by storing a cookie on your computer that contains a "session ID". This is an identifier that your computer sends to the server with every page request during this session. The server checks this to make sure you logged in.
What if another website could steal your cookies? If someone could get a hold of your session ID while you were logged in, they could potentially get into your account without even knowing your password!
Luckily, your browser will only send the cookie (containing the session ID) back to the website that it came from so you don't have to worry too much about other websites stealing your cookies. However, if your website includes user input (such as a forum or blog comments) then you need to check it very carefully for what are known as Cross Site Scripting (XSS) attacks. This is when an attacker submits content to your site to inject code into your webpages which is then viewed by other users. Since 2007 XSS attacks have accounted for 80% of reported website attacks.
Another concern with user input is that most websites today have some kind of database back-end. When you store user input into a database it must be carefully checked to ensure that it contains no malicious code that can interfere with operation of the database system. If user input is not properly checked before it is sent to the database then there is a chance a malicious user could retrieve secret information or corrupt your data.
Q: Is all user generated content rigorously checked and filtered before it is displayed on your website?
Q: Is all user input on your website filtered before being stored in a database?
3. Keep Up-to-date
New versions of software are released all the time. Open-source software is particularly good at finding and fixing security vulnerabilities because they usually have many more people involved in the development process than proprietary software. This is a major advantage only as long as you keep up-to-date with the latest software versions. Known vulnerabilities can often be exploited by malicious users so as soon as updates are available you should make sure you install them.
If you use a Content Management System, or blog software for example, and if you do not keep up-to-date then you leave yourself open to attack. If someone can work out what version you are using they can find out what vulnerabilities are available to exploit. We have seen stories of this on the forum here. Blogs getting defaced, or malware and viruses being embedded into pages without the owner's knowledge.
Q: Is your website running the most recent version of your CMS, templates, plugins, etc?
Q: Is your server running the most recent software?
4. Multiple Users = Multiple Accounts
Main administrator (root) login details should be kept highly secure. You should create separate accounts for people where possible and give them only the permissions they require to do particular tasks they need. It's a good idea to avoid using the main administrator account for your own daily website maintenance and use a separate account, reserving the main admin account for only occasions that require full server access.
When you change staff/moderators/outsource workers or suppliers you can remove accounts and setup new ones. I'm not suggesting that you don't trust the people you work with, but if you have accounts restricted to just the access they require then if an account gets compromised an attacker is limited in the amount of damage they can cause.
Q: Do you use separate accounts for all users?
Q: Do all your users only have access to the parts of the system they need?
5. Backups
Your site is probably made up of a combination of program code, configuration data, and content database. It is important to have a backup in-case you need to recover from hardware or software failure, but your backup routine is also an important factor in your security planning.
Most professional development teams will have program code and configuration data under version control. This stores a new version every time the code is changed. If a developer makes a change that either breaks something, or a designer makes a tweak to the layout that people don't like, you can restore a previous version of the code from any point in time. Because it is possible to compare different versions of the code you can see what has changed, which can be useful if your website security is compromised as you can discover what changes have been made by the malicious user by comparing to previous versions.
Content is usually stored in a database, and it's important to make regular backups (called "database snapshots") of your content. It depends on how frequently your data changes, and how much you can afford to lose. On a popular site where content is constantly submitted you will want to take a snapshot at least every hour. On a site that has less frequent updates you may want to do nightly snapshots. These backups can usually be automated in your server configuration tools.
Q: Do you have enough backups to easily restore the site to any point in time?
Q: If your server was completely destroyed today, how quickly could you be up and running again on a new system?
Summary
To recap:
Q: Are you using strong passwords?
Q: Is your website login system secure?
Q: Is all user generated content rigorously checked and filtered before it is displayed on your website?
Q: Is all user input on your website filtered before being stored in a database?
Q: Is your website running the most recent version of your CMS, templates, plugins, etc?
Q: Is your server running the most recent software?
Q: Do you use separate accounts for all users?
Q: Do all your users only have access to the parts of the system they need?
Q: Do you have enough backups to easily restore the site to any point in time?
Q: If your server was completely destroyed today, how would your business cope? how quickly could you be up and running again on a new system?
I hope you found this an interesting read. I don't mean to cause alarm unnecessarily, but if it helps just one person protect themselves against losing anything to hackers then it was worth posting. Thanks for reading.
Any Questions?
Largest Selection of PLR Articles on the Planet! PLR Ebooks, PLR Video, PLR Websites and more with Private Label Rights