Website Security

-
Hackers are constantly attacking websites and one day, even if your site is not experiencing huge traffic levels, a hacker might come calling at your door to test your security levels. How do you stop them from gaining access and possibly taking control of your website?

Passwords
Your site admin must have a strong password - never 'password' or other obvious words. A medium strength password will include a combination of numbers and letters, ideally using upper and lower case letters. Make it stronger by including other characters, such as @ -? etc. Anything that you can add that means your password is not a straight forward word or two can really improve it.

Ideally, also sign on with a user name that is not obvious - not 'admin', 'administrator' and so on. This way the hacker must guess user name and password. And if you can move your administration area to an unusual directory, then the hacker might not even be able to find it!

Watch what is happening
Monitor failed logon attempts to the admin and maybe close it down if there are too many. Be on the look out for multiple failed attempts from the same IP address and multiple failed attempts on the same user name. Hackers might use networks of computers to constantly submit different passwords to your admin and if these are hijacked computers, they will have different IP addresses, but they will all attack the same userid.

Be alert to traffic patterns
Watch your traffic stats for sudden interest in pages, especially pages that shouldn't be there and protect the code from SQL injection. And if any part of your website is uploading files then validate the format. I like to check that images are a valid image format and then put them through a resize algorithm. That way php / asp files cannot be uploaded and ran should a hacker gain entry to an admin system.

SQL injection
This is a popular way of reading your tables and trying to find out if you have passwords stored there and other malicious tricks, such as uploading content to your pages. Make sure that you use correct escape routines to remove any attempts to inject SQL into your code and on pages where all that is needed is a read only access, just use a read only user id. Then if someone slips in extra code the potential damage might just be limited.

You can also validate inputs to prevent SQL injection. For example, if you are expecting to be passed an id that is an integer, then test that it is an integer. If not, then I like to just exit the code immediately so that there are no extra clues given and the page stops loading immediately.

Popular posts from this blog

Network security

-
Image
Naturally, with the growing benefits of know-how, the Web & network configurations comes the growing danger of security breaches, identity theft & cyber crimes. Regrettably, electronic theft is becoming a greater danger to plenty of businesses across the globe, so how do business owners keep their information safe & secure? way to keep sensitive information secure is to constantly improve network security & to stay ahead of the game. Every day they listen to that computer viruses, hacker, & other security breaches have found new ways to steal identities, financial records & other information they thought historicallyin the past secure. Because of the increase in such cyber crimes, information protection laws have tightened & the punishments hardened. With this comes the necessity for all businesses to take information security seriously. It is important to improve network security for your business on a regular basis. Aside from encrypted ...
Read more

Dynamic Website Security

-
When the page lots, you won't see the PHP code but in lieu see the contents of the included file. In the case above, you would see your navigation links etc where they ought to be. At a most basic level, PHP can be used to simplify the navigation of a web-site by using the include function. This, added to each page of the web-site can be used to include a html file that contains the sites navigation links. The main advantage of this is that the webmaster can basically adjust that file, in lieu of every single page on the site. Obviously if your site has thousands of pages, this is going to save you some time! The include() function fundamentally tells the server your web-site is hosted on, to take what is in the included file & put it in to the code of your page. Typical use of the include function is as follows: There's lots of things a typical user can do which may cause you irritation, or in the case of a purchase form, cause you to never receive the order, e.g. mist...
Read more

Information Security Policies

-
Information security policies, whether corporate policies, business unit policies, or regional entity policies provide the requirements for the protection of information assets. An information security policy is often based on the guidance provided by a frame work standard, such as ISO 17799/27001 or the National Institutes of Standards and Technology's (NIST) Special Publication (SP) 800 series standards. The Standards are effective in providing requirements for the "what" of protection, the measures to be used, the "who " and "when" requirements tend to be organization-specific and are assembled and agreed based on the stakeholders' needs. Governance, the rules for governing an enterprise are addressed by security-relevant roles and responsibilities defined within the policy. Decision making is a key governance activity performed by individuals acting in roles based on delegated authority for making the decision and oversight to verify the decisi...
Read more