eCommerce website security - Guarding your digital storefront

How do we define eCommerce website security?

A secure eCommerce website effectively protects its users and the sensitive data it handles from the latest cybersecurity threats. It facilitates the buying and selling of goods or services through a robust framework of technical, organisational, and procedural measures.

These measures ensure the confidentiality, integrity, and availability of sensitive data, encompassing, but not limited to:

• Customer details
• Payment information
• Transaction records
• Company data

The latest threats posed to eCommerce website security

The threat landscape for eCommerce websites is constantly evolving, with cybercriminals continually devising new tactics and techniques to compromise security and access sensitive data.

One of the most significant concerns is the theft of customer data, including names, addresses, credit card numbers, and login credentials. Cybercriminals employ a variety of methods to do this, and these methods continually evolve, growing increasingly sophisticated over time.

Below, we will introduce you to the most poignant threats posed to your website.

SQL Injection

Cybercriminals may exploit vulnerabilities in an eCommerce website's code to inject malicious SQL queries into input fields.

In very simple terms, an SQL query is like asking a database a question in a language it understands. It's a way to request specific information from a database. 

Therefore, they can be maliciously used to access, modify, or steal data from your database, exposing sensitive customer information that can then be resold or held for ransom.

A prominent example would be the breach of 7-Eleven in 2007, stealing an ‘undetermined amount of card data’ - WIRED.

DDoS Attacks

You may have heard of Distributed Denial of Service, or DDoS, before.

It is a malicious attempt to disrupt the normal functioning of the website by overwhelming it with a flood of traffic.

In a DDoS attack, multiple compromised devices, often referred to as "bots" or "zombies," are used to generate this high volume of traffic, making it difficult for the targeted system to handle the load and causing it to become slow or unavailable.

The primary objective of a DDoS attack is disruption. It can lead to downtime, inconvenience, and financial losses for your business.

Backdoor Exploitation

Cybercriminals might discover or create hidden backdoors in your website's code to gain and maintain unauthorised access to your database. 

Backdoors are designed to remain hidden and active over an extended period, enabling attackers to maintain access to the compromised website. Backdoors can be used to evade your security measures, such as firewalls and intrusion detection systems, making it difficult for your administrator to detect and prevent unauthorised access.

This can allow them to retrieve sensitive data or, in some cases, even control your whole website. 

Backdoor access can also be achieved via outdated or malicious plugins. If you are using a heavily customisable website platform like WordPress (Woocommerce), it is vital that you only use accredited and verified plugins that are regularly maintained and updated.

Phishing

Phishing involves sending deceptive emails or creating fake websites to mimic yours.

When users enter their login credentials or payment information on these fake sites, the attackers capture their data.

This stolen information can then be used for various malicious purposes, including identity theft, financial fraud, or gaining unauthorised access to your accounts and systems.

Cross-Site Scripting

Attackers can inject malicious scripts into your website’s pages. When customers visit the product page and click on the feature with the script hidden, it starts running in their web browsers without their knowledge.

This can lead to the theft of login credentials, which in turn can be used to attempt to access further sensitive data.

Insecure APIs & Third-Party Vulnerability

Application Programming Interfaces (APIs) are sets of rules and protocols that allow different software applications to communicate with each other. If these rules and protocols are insecure, this can inadvertently expose sensitive data.

For example, vulnerable APIs may not properly enforce authentication and authorisation mechanisms. Attackers can exploit this to gain unauthorised access to your data or functionality, potentially compromising your entire system.

In 2018, there was a data breach that affected 380,000 to 500,000 customers of British Airways.

According to computer security expert Alan Woodward the attack was most likely carried out through a supply chain attack on a third-party payment utility used by the website. This script sent the submitted payment information to the attackers directly.

Assessing your vulnerability to threats

With countless transactions, sensitive customer data, and financial information passing through your website, safeguarding your integrity and reliability is not just good practice; it's essential.

Two key components in ensuring security are Vulnerability Assessments and Penetration Testing.

Let's explore what these terms mean, why they are crucial, and what they encompass.

Vulnerability Assessment

A vulnerability assessment is a systematic approach to identifying, evaluating, and mitigating vulnerabilities in a system - in this case, your eCommerce website.

It involves a comprehensive review of the website’s infrastructure, code, configurations, and security mechanisms to pinpoint weaknesses that malicious actors could exploit to undertake one of the actions outlined in the previous section.

These weaknesses might include unpatched software, misconfigured security settings, insecure APIs or coding errors that create potential entry points for cyberattacks.

By conducting vulnerability assessments, you gain a thorough understanding of your website's security posture and can take proactive measures to fix identified vulnerabilities.

We can quickly identify your vulnerabilities by running a full assessment of your infrastructure, contact us to get started.

Penetration Testing

Penetration testing, often referred to as pen testing or ethical hacking, takes vulnerability assessment a step further.

Instead of just identifying weaknesses, penetration testing involves actively attempting to exploit them, simulating real-world cyberattacks.

Skilled cybersecurity professionals use a variety of tools and techniques to probe your website's defences and uncover vulnerabilities that may not be apparent through static analysis alone. This proactive approach enables you to understand not only where the weaknesses lie but also how they can be exploited by potential attackers.

The results of a vulnerability assessment and penetration testing will provide a detailed analysis of your website's security posture. They will typically include:

1. A List of Vulnerabilities: A comprehensive report listing identified vulnerabilities, their severity, and recommendations for remediation.

2. Exploitation Techniques: For penetration tests, you will receive insights into how vulnerabilities could be exploited, helping you understand the real risks.

3. Mitigation Strategies: Recommendations on how to remediate vulnerabilities, including prioritisation based on severity.

4. Evidence of Successful Exploitation: If vulnerabilities are successfully exploited during testing, you will be provided with evidence to support remediation efforts.

An introduction to the key mitigation strategies

Various steps can be undertaken to improve and maintain the security of an eCommerce website, some of which can be implemented on your end, with others left in the capable hands of experts.

Below are various eCommerce website security measures, split into DIY and Advanced lists based primarily on the technical ability required to achieve them.

DIY eCommerce website security

Never collect or save unnecessary customer information

To enhance eCommerce website security, it's important to follow data minimisation principles, which involve only collecting and retaining the data that is essential for the intended purpose.

The more customer data a business collects and stores, the greater the risk of a data breach. Storing additional data increases the attractiveness of the site as a target for cybercriminals seeking to steal sensitive information, and it expands the attack surface for potential security threats.

You should regularly review your data collection and retention practices and purge any data that is no longer needed.

This reduces the amount of sensitive information that needs to be protected, simplifies your security measures, and minimises the potential risks associated with data breaches.

Password regulation for customers and staff

Regulating passwords is crucial for eCommerce website security and this must be applied to both customers and staff.

To mitigate the risk of cybercriminals forcing an unauthorised takeover of your customers’ accounts, your website must enforce a strong password policy that demands the user to set a unique password.

Many security standards and regulations, such as the Payment Card Industry Data Security Standard (PCI DSS) which we will discuss soon, require the implementation of strong password policies or risk financial penalties and legal consequences.

The same rules apply concerning employees who need access to sensitive data and the backend systems that run the eCommerce website. Enforcing 2FA or MFA adds an extra layer of security to user access, ensuring that even if credentials are compromised, an additional verification step is required for authentication. The best practice is to use a function that minimises the number of passwords your employees need to use across the business, making it much easier to enforce 2FA.

Foster a culture of security, compliance and wariness

Fostering a diligent and cautious culture should be an ongoing effort that involves every level of your eCommerce business.

This includes leadership setting a strong example, providing resources for security initiatives, and creating a collaborative atmosphere where employees and team members feel comfortable reporting security concerns.

By doing so, you can build a security-aware culture that promotes proactive security measures, such as regular security assessments, patch management, and vulnerability scanning, to identify and address security weaknesses before they can be exploited, protecting your interests and those of your customers.

Advanced eCommerce website security

PCI Compliance

‘PCI compliance’ refers to the Payment Card Industry Data Security Standard (PCI DSS), which is a set of security standards and guidelines developed to ensure the secure handling of payment card data, and is mandated and enforced by the major credit card companies, including Visa, MasterCard and American Express.

The standards and guidelines cover:

Data Protection

Specific requirements for protecting cardholder data including encryption, access control, and secure storage.

Secure Network Infrastructure

Implementation of firewalls, secure network configurations, and regular security testing to identify and address your vulnerabilities.

Vulnerability Management

Conduct regular vulnerability assessments and penetration testing to identify and remediate your security weaknesses. 

Access Control

Strong access controls, including unique user IDs, password policies, and restricted access to your cardholder data.

Security Policies

Enforcement of comprehensive security policies and procedures.

Incident Response Planning

Development of an incident response plan to handle security incidents effectively.

Vendor Management

Ensure that third-party vendors who have access to cardholder data also comply with PCI DSS.

Properly configured perimeter defences

Your perimeter defence is a combination of security measures and technologies designed to protect your website, servers, and data from external threats.

Effective eCommerce cybersecurity requires a layered defence strategy that combines these perimeter defences with internal security measures, security awareness training, and incident response planning to comprehensively protect your website and customer data.

Common perimeter defence tactics and technologies include:

Firewalls

Firewalls are essential in blocking unauthorised access to your website. They filter incoming and outgoing network traffic based on a set of predefined rules.

Web Application Firewalls (WAF)

WAFs protect against web-based attacks, such as SQL injection, cross-site scripting (XSS), and other application-layer threats. They filter and monitor HTTP requests and responses to identify and block malicious traffic.

Intrusion Detection/Prevention Systems (IDS/IPS)

These systems monitor network traffic for suspicious or malicious activity.

Intrusion Detection Systems (IDS) identify threats, while Intrusion Prevention Systems (IPS) take action to prevent or mitigate the attack.

Virtual Private Networks (VPNs)

VPNs establish secure and encrypted connections between remote users and your eCommerce platform. They are crucial for securing data in transit and providing secure remote access.

Arguably, one of the most convenient applications of a VPN is restricting access to internal tools solely to users connected to a company VPN. This restriction can be enforced by a firewall, thereby ensuring that employees can still access internal tools without exposing them to the general public.

Access Control Lists (ACLs)

ACLs are used to control and restrict access to specific network resources, such as servers and databases, based on source IP addresses, ports, or other criteria.

Content Delivery Networks (CDNs)

CDNs can help distribute website content to geographically dispersed users, improving website performance and providing DDoS protection by absorbing traffic spikes.

HTTPS, TLS and SSL

Your website must use HTTPS with a certificate that all major browsers accept. An HTTPS certificate, also known as an SSL/TLS certificate, is a digital certificate that helps secure the connection between a user's web browser and the server hosting a website. 

While you have likely heard of SSL, it is considered a legacy technology, and its early versions have known vulnerabilities. As a result, it has largely been replaced by its successor, TLS.

Your server settings must follow the current expected standards regarding what protocol is used (TLS 1.2 or 1.3 as of 2023) and what cyphers are enabled.

This encryption ensures that sensitive information, such as payment details and personal data, is protected from eavesdropping and interception by malicious actors.

Search engines, like Google, give preference to secure websites. Websites using HTTPS often receive better search engine rankings, not to mention that a secure connection with HTTPS contributes to a positive user experience and builds trust with customers.

Users are more likely to complete transactions and share sensitive information when they see the padlock symbol and "secure" message in the browser's address bar.

Taking regular backups

Backups serve as insurance against data loss due to various unforeseen events, including cyberattacks, server failures, human errors, and software bugs.

In the event of data corruption or loss, you can restore your website and customer data from backups, minimising downtime and financial losses.

In cases of ransomware attacks or malware infections that encrypt or damage data, having recent backups can provide a means to recover clean and unaltered data. This reduces the pressure to pay ransom demands and helps prevent data loss.

To ensure the effectiveness of backups for cybersecurity and business continuity, eCommerce businesses should consider the following best practices:

• Regularly schedule automated backups at convenient intervals (e.g., daily, weekly) to capture changes and updates to the website and data.
• Store backups securely and offsite to protect against physical and logical threats to the primary data. Google Cloud storage’s Retention Policy features ensure that backup files cannot be modified after being uploaded. This safeguards backup files from being tampered with. 
• Test the backup restoration process periodically to ensure that backups are reliable and can be restored effectively.
• Implement a comprehensive disaster recovery plan that includes backup procedures and guidelines for data restoration in the event of an incident.