The news frequently reports stories about hackers gaining access to credit card data for tens of thousands, sometimes millions, of consumers. The Target data breach of a few years ago cost the company over a quarter of a billion dollars. Small to medium size enterprises, in particular, have a lot to lose if a data breach occurs in their organization.
Hackers continually refine their methods, and there are so many types of attacks and vectors that business owners have a difficult time determining what do to. Technology changes quickly, offering new and better ways, such as tokenization, to help you protect your business.
You need to educate yourself as to the nature of the problem, types of attacks, and possible prophylactics available to protect your company from someone stealing your customer’s data.
Payment Card Industry Standards (PCI)
According to PCI standards, credit card numbers cannot be stored on a retailer's POS (point-of-sale) terminal or anywhere else after a transaction. For enterprises to remain PCI compliant, companies must invest in expensive equipment unless they take advantage of some of the new tokenization technology available.
Denial of Service
A denial of service (DoS) or distributed denial of service (DDoS) attack occurs when a hacker floods your router with traffic from different sources until the router becomes overloaded and fails. This will slow or disable your website and discourage customers from using your site.
Many systems have vulnerabilities to injection flaws. Crooks inject programs or untrusted data into your website and trick your system to access data or execute commands. This can cause not only data loss, but also file corruption, deny access to your site or data, and cause your system to crash.
Cross-Site Scripting (XSS)
Cross-Site Scripting, also known as XSS, can have devastating consequences to your enterprise. It is one of the most common types of attacks that can have a significant impact on your website’s reputation. Hackers target user sessions. If they can do so successfully, they can change your site, insert content, institute malware attacks, and, of course, steal data.
Authentication attacks are some of the most common ways criminals access your client’s data. Utilizing brute force, cyber crooks continually try logging in rapidly to your server. These types of attacks may involve attacking session IDs that keep track of users. A session ID can be used to impersonate someone and gain access to other accounts like Google or Twitter.
These attacks exploit weak passwords, exposed accounts, or other flaws. For example, there may be flaws in logout functions, password management, account updates, timeouts, or in other areas of your system.
If someone mistakenly misconfigures a security setting, a frequent mistake, criminals can exploit that weakness and gain access to your servers and the data it holds. Once they do so, stealthy hackers can, over time, carefully steal or modify your data without anyone knowing about it.
This type of attack reportedly was used on former Secretary of State Colin Powell’s email server, which—allegedly—criminals had access to for several years.
Traditional Methods of Protection
There are traditional methods of protection that can assist businesses to protect their websites from unauthorized access and exploitation. Some of these require drafting, implementing, and monitoring policy to help secure your site. Others require more robust technical measures to help keep your eCommerce site safe.
One of the most important things you need to do is require strong passwords using a minimum of six or more characters, including letters, numbers, and symbols. The longer and more complex the password, the better.
Enforce security training for all employees to help better protect your eCommerce site. Include discussions on the importance of maintaining strict control over sensitive data by never emailing it, sending it by text, or discussing it during a chat session.
Ensure your IT section sets up and receives system alerts for suspicious activity. Things like 