Best practices to protect your E-commerce business
What is the danger in the E-commerce sector?
Last few years were critical for many companies in the E-commerce sector, due to the high amount of cyber attacks and emerging threats. Study of Business Insider shows that for the period of one year at least 16 separate security breaches have occurred at large retailers. Many of them are due to security flaws in payment systems. Recent report by shape Security showed that many people that log in to a retailer’s E-commerce site are hackers using stolen data. This is the highest percentage of any sector. Some of the largest retailers like Adidas, Macy’s, Best Buy, Forever 21 and others have been affected.
Large amount of compromised data is being sold on “dark web”, including databases with personal data, credit card numbers and confidential corporate data, used by the competitors. Another issue in the sector is being caused by the high amount of IoT devices, which allow more and better ICMP and DDOS attacks to be crafted. Many vulnerabilities are caused due to input validation errors, client side gaps, vulnerabilities in database servers or network related vulnerabilities.
It is very important for an E-commerce organization to provide layered security infrastructure, as well as to perform regular assessments in order to check the security of their systems, networks, web and mobile applications and employees.
GDPR and other law requirements provide a strong challenge for most organizations, operating with personal data.
In the white paper we will observe the following topics:
- Some of the issues that you can face.
- Famous attacks in the sector.
- Protection mechanisms.
- Basic security measures.
Some of the issues that you can face
☠ Client threats
- Active or malicious content
Active content is usually software that enables content to be provided on a Web site. In terms of E-commerce, it is used by shopping cart software in order to place items in the shopping cart of the consumer and to calculate other costs for that purchase. Malicious hackers often use a Trojan horse, or a software program that seems legit, but has an unethical purpose.
Graphics, plug-ins for various browsers, and e-mails with files attached can also infect the user.
- Server-side masquerading
Masquerading makes a user to believe that the entity he is communicating with is a different entity. Example would be if a user tries to log into a computer system across the internet but instead gets redirected to another computer that claims to be the legit one. This is usually an active attack in which the masquerader issues response in order to trick the user about its identity.
☠ Communication channel threats
- Confidentiality threats
In terms of Confidentiality, Information should not be accessible to an unauthorized person. It should not be possible for information to be intercepted during the transmission. An attack against confidentiality might include Injection, Unauthorized access, Sensitive data exposure, Packet sniffing, Password attacks, Port scanning, Dumpster diving, Keylogger, Phishing attacks and more.
- Integrity threats
When we talk about integrity, Information should not be altered or changed during its transmission over the network, in storage or during processing. Attacks related to integrity might include, but are not limited to Data tampering, Broken Access Control, data diddling, Salami attacks, MITM, Session hijacking and more.
- Availability threats
Information should be available wherever and whenever it is required within a specified time window. In terms of availability, common attacks are DoS, DDoS, SYN flood, Electrical power attacks, Server room environment attacks and others.
☠ Server threats
- Web-server threats
In terms of web security there are advanced hacking techniques, causing a lot of damage. However, some of the common methods to attack a web server are URL interpretation, Session hijacking, HTML injection, SQL injection, Website defacement, Directory traversal, Misconfiguration attacks and more.
- Common gateway interface threats
A common gateway interface (CGI) takes care for the transfer of information from a web-server to another program or database. CGI and the corresponsive programs provide active content to web pages. Because CGIs are programs, they present a security threat if not used properly. Just like web-servers, CGI scripts can be configured to run with high privileges. Defective or malicious CGIs with free access to system resources might call privileged base system programs to delete files, disable the system, or read confidential consumer information, including usernames and passwords.
- Password hacking
People understand that good password security is crucial for protecting sensitive systems and data, however many of them struggle to apply good security policies and systems are regularly compromised via breached user accounts.
Users should use strong passwords that are not easily guessed. A good password would be more than 12 characters in length, using upper and lower case letters, and with special characters in use.
However, hackers use many methods in order to compromise a user’s password, different than stealing it straight from the database or guessing it.
Some of the most famous methods are:
1. Dictionary attack – it uses a simple file containing words.
2. Brute force attack – it tries every possible combination.
3. Rainbow table attack – it uses a list of pre-computed hashes.
4. Phishing –it uses a fake website or login form to trick the user.
5. Social engineering – it relies on person’s unawareness.
6. Malware – mostly key loggers or screen scraper are used.
7. Offline cracking – password cracker is used to crack hashes.
8. Shoulder surfing – passwords are being entered by members of the staff.
9. Spidering – it uses a custom built corporate related word list.
10. Guess – it relies on predictability of the user.
Famous attacks in the sector
Malware is malicious software, developed by malicious hackers to gain access or cause damage to a computer system or network, often without the knowledge of the affected user.
Malware is often called ‘computer virus’, although there are big differences between these types of malicious software.
Magento and other E-commerce platforms are particularly vulnerable to widespread malware infections due to their prevalence in the market. Malware can perform an extremely wide range of activities. It can use your computer as part of a botnet in order to launch DDOS attacks, steal credit card numbers or sensitive account information from the users of your website. A famous malware, intended to target Magento sites, had the functionality to extract credit card information and store it in images so that the attacker could easily access it without raising any alarms.
☢ SQL, XSS
SQL Injection (SQLi) is an injection attack in which an attacker executes malicious SQL statements with variable payload in order to get access to a web application’s database server (also known as a Relational Database Management System – RDBMS). SQL Injection is one of the oldest and most dangerous web application attacks and could affect any website or web application that makes use of an SQL-based database.
Cross-Site Scripting (XSS) attacks are also a type of injection, but they use malicious scripts which are injected into trusted websites. An attacker can use XSS to send a malicious script to trick an unsuspecting user. Some browsers cannot recognize the malicious script and will execute it, affecting the user.
☢ Vulnerabilities due to input validations
The most common web application security weakness is the failure to properly validate input coming from the client or the environment before using it. Most of the web application vulnerabilities are due to input validations, such as SQL injection, cross site scripting (XSS), interpreter injection, locale/Unicode attacks, buffer overflows and file system attacks. Data from an external entity or client should be carefully inspected, as there is a high chance that the data is modified by an attacker.
☢ Log Injection
Log files can be used by an attacker to inject malicious content or forge log entries if there is a vulnerability which allows unvalidated user input to be written in the logs.
Log injection vulnerabilities occur when the data comes from an untrusted source or the data is written to an application or system log file.
Log files are typically used by the applications to store a history of events or transactions which could be later reviewed. Logs could also be used for statistics gathering, or debugging. Depending on the application’s functionality, log files could either be reviewed manually or with the help of automated tool that automatically reads logs and searches for trending information or important events.
Log files might get corrupted if an attacker can supply data to the application that is subsequently logged verbatim.
☢ Missing XML Validation
XML Injection is present when a malicious user tries to inject an XML doc to the application. If the XML parser fails to contextually validate data, the attack will know that there is a present vulnerability. E-commerce platforms are often being affected by XML Validation vulnerability.
☢ Bad bots
Bots have many names – crawlers, spiders, Internet robots, web bots and more. They are frequently used to perform repetitive jobs and simple tasks, like indexing a search engine. However they often come as part of a malware. They are used to gain full control over a computer system. Some of them have the functionality to infect the host and connect back to a CNC (command and control) central server(s), which could be used to control a network of compromised computers and hosts.
- Fraud – Bots can prevent your legit users from purchasing items by sending many purchasing requests for an item in order to make it appear out of stock for your clients. They can also list your items for sale in other sites at a lower price. Bots could also be used to attempt to brute-force the credentials of your consumers. In case of a successful login they can also resell the information to a third party. In case that someone is able to use the credit card of your clients, that could ruin the trust among them.
- Price Scraping – Price scrapping is a technique used to craw an online store for its prices along with product catalog information, with the help of bots. It is often used by competitors in order to steal the dynamic pricing of a website, which is extremely important in the E-commerce platforms. The reason for this is that many consumer-buying decisions and revenue forecasts rely on the real-time dynamic pricing. Such hacking method would allow the competitors to set prices lower than baseline prices in the marketplace and therefore attract more consumers.
E-commerce transactions offer the banking industry a great opportunity, but they also present risks and security threats. From management and technical point of view, Information security is crucial aspect for any efficient and effective Payment transaction activities in Internet. In the E-commerce sector money transactions require a coordinated setup of algorithm and technical solutions.
Nowadays in the payment industry an important security measure is the so called EMV, which stands for Europay, MasterCard, and Visa. It presents a global standard for inter-operation of chip cards, ATMs and POS terminals for authenticating credit and debit card transactions. Chip cards are the successor of the previously used magnetic strip cards. The chip however does not affect online payments, due to the fact that the buyer is required to manually enter the card details. The benefit is that it is much harder for the hackers to clone the card when such chip is present.
In terms of mobile payment security, the fingerprint feature provides a good layer of security, as it expects the physical presence of the person to authenticate. Biometric identification is much harder to be bypassed than the traditional account credentials.
For the merchants it is a good practice the PCI DSS standard certification to be complied.
Some of the benefits that PCI-DSS provides are:
- Peace of mind – The first benefit that comes along with PCI DSS compliance is the fact that you get increased peace of mind.
- Better customer relationships – PCI DSS provides an undisputed advantage in the maintenance of customer relationships.
- Universal principles – PCI DSS is designed to be able to apply to any company which processes and stores customer payment card data, by obligating the company to follow 12 criteria across six security areas.
In order to provide multi-currency and cross-border transactions most merchants prefer to use e-wallets and mobile payments. When choosing a provider for the above it is important to choose one with a secure infrastructure to mitigate the aforementioned issues.
A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Online stores are especially vulnerable to those attacks especially during discount periods, like Black Friday. However, there are easy to implement measures, to protect against such type of attacks.
Ping requests are used to test the network connection between two computer systems by measuring the round-trip time from when an ICMP echo request is sent to when an ICMP echo reply is received. They could also be used for malicious purpose in order to overload a target network with data packets.
For launching ping flood attack, knowledge of the remote IP is a must. Attacks can be grouped in three main categories, depending on how the remote IP address is resolved.
- A router disclosed ping flood.
- A targeted local disclosed ping flood.
- A blind ping flood.
Man-in-the-middle attack is a common type of cybersecurity attack that allows attackers to eavesdrop on the communication between two targets. Hackers can use a variety of ways to conduct such attack, like IP spoofing, DNS spoofing, HTTPS spoofing, SSL hijacking, Email hijacking, Wi-Fi eavesdropping or Stealing browser cookies. In case of a website using HTTPS it is important to note that in specific circumstances the attacker might be able to strip the secure layer and force the web server to present an HTTP version of the website, therefore exposing the user credentials to such attacks.
E-commerce has not been able to achieve its full potential yet, due to the media news and frequent warnings about threats and risks related to the online transactions. Many people lack security awareness and are still afraid to perform online transactions due to the fear that someone might steal their money. Instead consumers should use online stores which prove to use trusted payment methods and follow all security requirements to reduce the risk.
☢ Vulnerability in IPS
The purpose of intrusion prevention systems is to identify and block any type of malicious activity as well as to provide quality log and report information about the malicious activity. IPS devices by default are secure, except in the following conditions:
- Under estimation of security capabilities, including information gathering, logging, detection, and prevention.
- Non-defined Management policies.
- Focus on Performance rather than security.
☢ Vulnerabilities in firewall
Firewalls are usually important assets of every network security infrastructure. Their job is to restrict the inbound do outbound access and vice versa to specific IP addresses and networks. Firewall vulnerability might be caused because of an error made during firewall design, implementation, or configuration that can be exploited to attack the trusted network behind the firewall. Some common firewall vulnerabilities and misconfigurations include:
- Allowed ICMP traffic.
- Blocking traffic, instead of dropping it.
- Lack of port restriction.
- Unrestricted access to specific IPs and networks.
- Unnecessarily open TCP and UDP ports.
⚔ Penetration testing
Penetration testing tools simulate real-world attack scenarios to discover and exploit security gaps that could lead to stolen records, compromised credentials, intellectual property, personally identifiable information (PII), cardholder data, personal, protected health information, data ransom, or other harmful business outcomes.
Pen Testing can be accomplished either through manual or automated processes. Tests can be divided in a few categories. Depending on the scope, they could be targeted towards:
– Network equipment – Servers, Network endpoints, Wireless networks, Network security devices, Mobile devices.
– Software applications and the code behind it (including Web, Mobile or Desktop applications).
⚔ Vulnerability scanning
Vulnerability analysis, also known as vulnerability assessment, is the process of identification and classification of security holes (vulnerabilities) in a computer, network, or communications’ infrastructure. In addition, vulnerability analysis can forecast the effectiveness of the proposed countermeasures and evaluate their actual effectiveness after they are put into use. They are usually conducted using mainly automated tools. Unlike the penetration testing, vulnerability assessment does not try to exploit the identified vulnerabilities in order to prove their truthfulness and impact on the business.
Vulnerability assessment aims to:
- Define and classify network or system resources and assign relative levels of importance to the resources.
- Identify potential threats to each resource and develop a strategy to deal with the most serious potential problems first.
- Define and implement ways to minimize the consequences if an attack occurs.
⚔ Network firewalls
Firewall is a must in large corporations, as usually complex solutions are in place to protect their extensive networks. Firewalls can be configured to prevent access to certain websites (like social media or sites for online gambling) or they can be configured to prevent employees from sending certain types of files or emails or they can be caught when transmitting sensitive data outside of the company network.
Their second purpose is to prevent outside users from accessing systems inside the network. A company might choose to implement a single file sharing server on the network and restrict all other computers. Extensive and complex configurations require strict handling and they need to be maintained by highly trained Network Security specialists.
A web application firewall (WAF) applies a set of rules to an HTTP communication. It is referred to as firewall that protects web applications. It relies on rules that cover common web application attacks such as SQL injection, cross-site scripting (XSS) and more. In comparison with the proxies, which are used to protect clients, WAFs could be considered as reverse proxies, used to protect servers. WAFs may come in the form of an appliance, server plug-in, or filter, and may be customized to a specific application. As well as the network firewall, WAF also requires serious customization and needs to be maintained as the application is modified.
⚔ IPS/IDS devices
Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) are among the most sophisticated network security devices in use today. Their job is to carefully inspect network packets, block the ones with malicious content and alert administrators about attack attempts. These systems’ logs contain valuable information about attack types, network threats, targeted devices, and more. IPS logs should be extracted and carefully analyzed to prevent future attack attempts.
⚔ SIEM and SOC
A SIEM (Security Information and Event Management) is a technology which provides network security visibility by indicating suspicious and non-legitimate activity through predefined rules and correlation intelligence. SIEM solutions allow security analysts to investigate suspected threats. They collect and normalize logs in order to be tested against a set of correlation rules that when triggered are expected to create events which could be later analyzed by security analysts.
A SOC (Security Operations Centre) encompasses the People, Processes, as well as Technology involved in protectively-monitoring a network. SOC team is a centralized unit of security analysts and other security experts that deals with security issues, using a variety of tools. They are responsible to react to security incidents and actively research known or 0-day threats. One of the main tools used by security analysts is a SIEM.
Basic security measures
- Encryption – One of the most important methods to provide security is by converting readable into encoded text, especially for end-to-end protection of data transmitted across networks.
- Digital signature – Those are electronic “fingerprints” in the form of a coded message. The digital signature securely associates a signer with a document in a recorded transaction using PKI.
- Security certificates – SSL Certificates digitally bind a cryptographic key to an organization’s details. After installation on a web server it activates the padlock and the https protocol to provide secure connections. Typically, SSL or TLS is used to secure data transfers, logins and credit card transactions.
- MFA – It uses several different factors to verify a person’s identity and authenticate them to access specific software, system or the residing data. MFA systems use two or more ways to authenticate individuals.
- SSO – A user authenticates him at the beginning of their work using a master sign-on. In case that they require to authenticate into another system or software, the SSO solution logs in on their behalf.
- Create and maintain a secure network and systems
- Implement strong access control mechanisms
- Protect cardholder data
- Maintain a vulnerability management program
- Regularly monitor and test the security of networks
- Maintain an information security policy and procedures
- Card holder’s digital wallet – Digital wallets provide card holders with a secure and convenient way to store and use their payment cards without the need of carrying their physical cards. A digital wallet is a device or system which stores digitized versions of payment cards.
- Merchant software – Merchant application is a comprehensive system used to help merchants, retailers and distributors improve their business performance.
- Payment gateway server – A payment gateway is a merchant service provided by an E-commerce application service provider, used to authorize credit card or direct payments processing for e-businesses and online retailers.
Good security measures are just as important about the functionality capabilities of every E-commerce platform. A cyber attack could ruin the trust among your consumers, could lead to stolen credentials or financial and legal consequences. There are many security solutions on the market which could be implemented – some of them more expensive than others. However, good expertise is needed in order to choose the right expertise for your organization.