Most people like to watch online video. Some business owner remain doubtful about the profit of incorporating online video into…
Musings About Web Site Security
I have come to the realisation that I spend an incredible amount of time on the web. My work is all about the web; at home I visit websites for leisure; even when I’m out and about I use my smartphone to check my e-mails and compare high street prices. I’ve often wondered about how safe I am from malicious websites but my recent musings have been about how safe websites are from me (well, us, the end-user).
In recent months I’ve come across more and more sites that have become comprised with malware, phishing scams and other defacements. Most recently I’ve come across a site that has been hacked more than once and each time the defacement was to add a hidden link farm. All of this has prompted me to think about web site security
I come from a security conscious background and, as you can probably tell, I also think a lot. Here are some of my more coherent musings and ideas about website vulnerabilities.
- It is sad but true that the weakest link is often the squishy human link. Social engineering, is a classic example of a vulnerability, this is the manipulation of people to get access to information. The text-book example would be, someone calling you and tells you they’re “Bob from the IT department” and they need your web server password to apply a patch.
- There’s a rule I live by while I’m wearing my developer-hat, any input needs to be validated, verified and sanitized. Not necessarily in that order. Any time a website takes an input; that is a potential point-of-entry (PoE) for a malicious user. Inputs can include form submission, cookies, sessions and URI. The most common hacks using this PoE are SQL Code Injection and privilege elevation.
- Everyone knows that systems have defaults and common user names and passwords are an open secret. There’s a good chance that any hacker will know them too, so please stop using “admin” and “passw0rd1” for your administrator account. This not only applies for user accounts but anything else that uses default or common names.
- The key is to restrict access to only those that need it. If a database only needs to be accessed by the web-server, restrict access to only that server. This can be considered in the design stage of a web sites’ architecture with having a firm distinction between the presentation and data layers.
Contact HeyGoTo at (702) 475-4227 or go to www.HeyGoTo.com today to find out how we can help you! To read more industry information go to the HeyGoTo Blog at http://heygoto.com/wordpress/
The following two tabs change content below.
My Mission is to Motivate & Empower others to Genuinely Succeed with Online Marketing through Training & Mentoring!
Latest posts by David Moceri (see all)
- - August 12, 2023
- Internet Marketing – The Art of Capturing Market Share - May 20, 2017
- Top 3 Social Media Mistakes Online Marketers Need to Avoid - December 31, 2016
This post was written by David Moceri
