WordPress

Does Website Security Matter to My Business?

So, Equifax was hacked, but your company doesn’t have a treasure trove of financial data. Do you really have to worry about website security?

For many businesses, website security is legally required. If you accept credit card payments or store medical data, you are required to secure your customers’ information. There are specific protocols for PCI (credit card) and HIPAA (medical information) compliance. But even among our clients, these are the exception rather than the rule.

I don’t store valuable data. Why should my website be secure?

Perhaps you’re an artist, a freelance writer, an attorney, or a veterinarian. Generally, your website doesn’t store much data at all. It’s simply a resource for information.

Sure, the antivirus companies want your money, and your domain registrar wants you to have something called an SSL certificate, but if you aren’t protecting anything valuable, why put a lock on your door?

How Mediastead Secures Our Clients’ Websites

At Mediastead we rarely work with companies that store critical data online. Most of our clients rely on us for web development and hosting. A few companies have databases of their inventory and sales and a few companies have information that needs to be protected for HIPAA compliance.

However, our security process doesn’t vary depending on the client. We use the exact same process to make sure our security plug-ins are kept up to date.

Our preferred platform, WordPress, is used by roughly 20% of all websites worldwide. By sheer volume of users, it makes a very attractive target for hackers. Native WordPress security is reasonably good; however, no platform can ever keep pace with malicious hackers attempting to circumvent this security. For that reason, we also license another proprietary security software for our servers.

The Mediastead team patches every client website at least once a month. Occasionally, a serious threat is announced in the WordPress community, usually having to do with a virus, Trojan horse, or active hacking attack. When this happens, all servers are patched the same day the fix is made available, usually within 24 hours after the vulnerability has been identified.

Every website should be secure.

Obviously, if you do store proprietary data within your website structure, you want to protect that data.

More likely you store data off-line, but if your website is connected to that database it could be used as an on-ramp or a lockpick. For example, your website may be connected to your inventory database, which is connected to your point-of-sale cash registers. Even though your website doesn’t store credit card data, smart hackers can use it as a lockpick. A deadbolt secures your house, but a good thief knows to look for the fake plastic rock in the flower bed.

Finally, hackers might not even want your data. Most small business website hacks aren’t looking for data. They are looking for empty server space and unused bandwidth.

Your Website May Have Helped the Equifax Hackers

The Equifax hackers had access to thousands of terabytes of data. They didn’t download it all onto a personal laptop or even a room full of servers. They likely stored it in chunks across many different servers all over the web. Even if the FBI or SEC trace the data, it’s being stored in unused disk space on Web servers for thousands of legitimate small businesses.

Next, they want to reap the benefits of their heist. The hackers will spam the millions of email addresses they recently captured. They won’t blast them from a single laptop in a seedy Internet café. They are going to piggyback on the outgoing mail servers of tens of thousands of websites, perhaps yours.

Meanwhile, your small business is paying for that storage. You’re paying for the bandwidth. And you may also be hosting the email server.

This last element is the most dangerous to you. The illicit activity is traced back to your IP address. No, the FBI probably isn’t going to bust down your door. But Internet security firms keep a running list of unscrupulous IP addresses. If your website or your email server is identified as associated with spambots, you’ll be blocked from reaching many of your potential customers, and you may never realize it.

How can you tell if your website has been hacked?

Most of the time, it’s pretty hard to tell from the business owner perspective. Usually, the business owner doesn’t suspect hackers, they tend to believe that their problems are the result of a bad website development team.

Business owners may see three symptoms of a hack:

Search engines aren’t finding you effectively anymore.
Outgoing emails are disappearing or bouncing back.
Your website seems to run much slower than it has in the past.

Even a well-developed website will eventually be vulnerable if security and functionality patches aren’t kept up to date. Many clients come to us after ignoring their website for more than a year. They rent supercheap server space, or they have a developer that charges by the hour to do updates, so they don’t bother updating until something breaks.

Every website, particularly ones hosted using WordPress, Joomla!, Drupal or one of the other popular platforms, should be patched monthly at a bare minimum.

In late 2016 Google began recommending that all websites have an SSL (secure socket layer) certificate and all data transferred to or from your website be encrypted. In January 2017, Mediastead made the decision that SSL certificates were going to be standard operating procedure for all clients. We want to protect all of our clients, not just those who store highly valuable data in their website.

Making sure your website and any of your servers connected to the Internet are routinely patched is critical not only for your data protection, but the protection of your ability to communicate unfettered.

Panamanian law firm, Mossack Fonseca, lost mountains of data in likely the biggest Internet data breach in history. The contents of the Panama Papers, as well as its sheer volume, was acquired through a series of cyber hacks.

News organizations reported that the hacked websites were WordPress and Drupal. They implied that these two platforms have subpar security. One interview I saw suggested that being open source meant reduced security.

WordPress and Drupal, however, are not to blame for this massive hack. The fact that they are free and open source is definitely not to blame, because the first of three hacks occurred on a platform made by the largest for-profit software company in the world, Microsoft.

Unsecured email started the data breach.

The breach started with Microsoft Outlook server. The company had been using an on-site server for email running software from 2009. They allowed access to the server using a web interface. Email has always been generally considered as insecure, and Microsoft never added encryption to this outdated software.

Today thanks to Google, most email is actually quite secure. Google, Microsoft, and all the big players in email have raised the bar on encryption which provides quite adequate security for most businesses, and probably would have been enough to protect the firm from a random hacker.

It’s likely that the hackers discovered the treasure trove of data via unsecured email. Once they figured out which platforms were being used, hacks for them are easy to find. However, both WordPress and Drupal are updated constantly every time a new exploit is discovered. There are hackers whom specialize in WordPress, trying to crack it specifically to help the community close up loopholes.

Unfortunately, they were using slightly outdated version of WordPress and a three-year-old version of Drupal. We use WordPress (and Drupal on occasion) but our clients rely on us to keep them up-to-date.

Had Mossack Fonseca been clients of Mediastead, we would’ve kept their data secure for $49 a month.

This so-called “hacker” wasn’t a hard-core professional, and was likely someone with basic knowledge of hacking, perhaps a journalist level of knowledge (wink wink).

The law firm created more than 200,000 individual companies specifically to hide money from a variety of government entities for the purpose of stashing billions of dollars out of sight of the taxman.

It reminds me a little bit of “The Firm” by John Grisham. He says if you want to bring down the mob, bring down their lawyers. Apparently it also works when toppling heads of state.

Every month Mediastead patches our WordPress websites with the latest updates. This assures that our client sites continue to function properly, and have the latest security. Occasionally we are alerted to a particularly nasty exploit, and we update every site within 24 hours.

Panama Papers isn’t the largest hack in history.

In terms of data volume and hard target search, the Panama Papers is huge, multiple terabytes of data and millions of documents.

The most prolific hack was a virus called Heartbleed. It infected millions of websites all of them on the WordPress platform. However WordPress had repaired the exploit months before, and the original exploit was discovered by a member of the volunteer community, a network of 20,000 coders that contribute to the open source knowledge bank.

Heartbleed infected lots of websites, but all of them owned by users who didn’t run security updates. The virus came and went and our clients, as well as millions of others that use professional Web service firms, were never impacted.

What have we learned?

Originally this was an email hack, not a website hack. The websites were highly targeted attacks.
WordPress and Drupal (or even Microsoft) were not to blame. Mossack Fonseca’s IT guy or girl is to blame, and I wouldn’t want to be in their shoes today. They may be made of cement.
If you’re going to hide billions from the taxman, at least have the foresight to spend $49 a month to keep your security up to date.

I, for one, am quite happy that a law firm with low scruples also apparently has an IT department with equally low scruples.

I’m also quite glad that, so far, American officials have not been accused. Are we less corruptible? Or do we just have better IT guys?

If you are geeky like us, here’s a good summary of the happenings from a web developer point of view.

Outdated and Vulnerable WordPress and Drupal Versions May Have Contributed to the Panama Papers Breach via WP Tavern

Do I Really Need a Secure Website?