SecurityBrief Asia logo
Asia's leading source of cybersecurity and cyber-attack news
Story image

eCommerce requires beefed up cybersecurity to function well

By Sara Barker
Tue 20 Feb 2018
FYI, this story is more than a year old

In an increasingly interconnected world, online shopping and electronic transactions have now transcended its innovation status to become part of our daily lives. Its ease of use and convenience, can also mean significant security risks since sensitive information and personal data are routinely shared among business owners and shoppers.

Some these security risks include the following:

Financial data theft/fraud: Many attackers target personal information such as names, addresses and credit card numbers. This allows them to make purchases online using someone else’s payment information. One method being used is called pharming or using fraudulent websites to manipulate people into giving out their credentials.

Another more effective and insidious method is deliberately targeting specific users and manipulating them into giving their personal information (also known as spear phishing). Other exploits used to steal financial information include, but are not limited to: SQL Injection, Cross-Site Scripting, Path Traversal, Session Hijacking, and Drive-by Downloading

Distributed Denial of Service (DDoS) attacks: A Denial of Service attack’s aim is to take down eCommerce sites by flooding them with requests. This kind of attack overloads the eCommerce site to the point where it can’t handle anymore requests, making the service slow down or even go offline.

Slow service for an eCommerce site means loss of potential revenue and massive impact to brand reputation.

Man in the middle attack: Man in the Middle attacks do exactly what they say — the attacker eavesdropping or intercepting the user’s (in this case, the online shopper’s) connection with the website. Even with Secure Sockets Layer (SSL)/Transport Layer Security (TLS) in place, there are still ways attackers can trick the browser to gain access to the plain text data.

Effects of a security breach for an eCommerce site

If such an attacker manages to compromise an eCommerce site, the following can happen:

Loss of revenue: The first, most obvious effect of a security breach is loss of income. Small businesses shell out an average of $38,000 to recover from a single data breach in direct expenses alone. On top of that, a company that experiences a security breach can also be held accountable for not following data protection policies, leading to hefty fines that can lead to a business’s insolvency.

Damage to brand reputation: Apart from the direct loss of sales due to site unavailability (due to a DDoS attack, for example), losses of sales can also be due to customers walking (or in this case, browsing) away from the shop in favour of other shops without such security breaches. Losing customers’ and stakeholders’ trust is the most harmful impact of a security breach.

People will not do business with a breached company, plain and simple.

Even if the company is eventually able to recover the financial losses, the impact on the company’s reputation would be a scar that would take a significant amount of time to fade. That is, if it even fades at all.

Intellectual property theft/damage: Another impact of a security breach is theft and damage to intellectual property like trade secrets, blueprints, and anything else that gives a company their competitive advantage. This can mean missing out on expanding the business since the company can no longer fully implement new and innovative ideas brewing in the pipeline.

How to protect eCommerce sites

The good news is there are ways eCommerce shop owners can protect their websites, their customers, and their data:

  • Research on the eCommerce platform and payment gateway the eCommerce business runs on to ensure it complies with information security standards. Make sure the platform is compliant with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is an information security standard defined to control how credit and debit card information is handled. To determine if the eCommerce platform is compliant, refer to Visa and Mastercard’s compliant service provider lists.
  • If you plan to implement your own platform using open-source platforms like Magento, then the responsibility is on the shop owner to implement security measures. Ensure that your shop is PCI-compliant and other basic security measures are in place.
  • Make sure the entire site (not just the payment area) uses HTTPS and do keep the SSL certificate updated. The certificate creates a secure connection between the user and the server. Otherwise, the data is easily accessible and readable by anyone. Contact your hosting provider if the shop is not hosted via HTTPS.
  • Only store customer data that is needed and make regular backups of them.
  • Conduct a vulnerability scan on the online shop. Even with security measures in place, it is possible that the site is still vulnerable from threats that are not obvious to the end user. This is where a web scanner comes in. Web scanner scans web applications for known vulnerabilities by spidering through links and ignoring pages linked outside the target domain.

Security is number one from day one

Hackers and cybercriminals only get smarter and more sophisticated with each passing year. Therefore, the onus is on business owners to make security a priority.

While a cybersecurity endeavour takes a lot of time and resources, the upfront cost is still lower than the potential losses and is a worthwhile investment for all eCommerce setups.

Article by Horangi Cyber Security cyber operations researcher Samantha Cruz.

Related stories
Top stories
Story image
Artificial Intelligence
How to ensure ethical deployment of AI implentations
The increase in automation and machine technology such as AI and machine learning has unlocked a whole new level of scale and service to organisations. 
Story image
Digital Transformation
How to modernise legacy apps without compromising security
At a time when digital transformation has become central to business, even the most important applications come with a ‘use-by’ date.
Story image
Ransomware
A third of companies paying ransom don’t recover data - report
Veeam's report finds 76% of businesses who are victims of cyberattacks paid the ransom to recover data, but a third were still unable to get their information back.
Story image
Artificial Intelligence
AI-based email security platform Abnormal Security valued at $4B
"A new breed of cybersecurity solutions that leverage AI is required to change the game and stop the rising threat of sophisticated and targeted email attacks."
Story image
Ransomware
Zerto unveils updates to ransomware recovery capabilities
"Organisations face increased risks from the volume and sophistication of ransomware attacks prevalent today."
Story image
BeyondTrust
BeyondTrust integrates Password Safe solution with SailPoint
BeyondTrust has announced the integration of BeyondTrust Password Safe with SailPoint identity security offerings.
Story image
Tech job moves
Tech job moves - Cisco, Hitachi Vantara, Tricentis & Zscaler
We round up all job appointments from April 28 - May 5, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Artificial Intelligence
Updates from Google Workspace set to ease hybrid working troubles
Google Workspace has announced a variety of new features which will utilise Google AI capabilities to help make hybrid working situations more efficient and effective.
Story image
Malware
Use of malware, botnets and exploits expands in Q1 2022
"As zero-day attacks and other vulnerabilities among companies like Google and Microsoft come to light, threat actors are quickly adjusting their tactics."
Story image
Cybersecurity
New report reveals evolving techniques targeting cloud-native environments
Companies are adopting cloud-native technologies faster than ever before. Unfortunately, with new technology comes new threats and challenges.
Story image
Malware
Sharp increase in phishing as cybercriminals leverage SEO to lure victims
"Malware lurking everywhere, from cloud apps to search engines, leaving organisations at greater risk than ever before."
Story image
SaaS
Absolute Software expands Secure Access product offering
Absolute Software is enhancing its Secure Access product portfolio, enabling minimised risk exposure and optimised user experiences in the hybrid working environment.
Story image
Sift
Sift shares crucial advice for preventing serious ATO breaches
Are you or your business struggling with Account Takeover Fraud (ATO)? One of the latest ebooks from Sift can provide readers with the tools and expertise to help launch them into the new era of account security.
Story image
Cybersecurity
The 'A-B-C' of effective application security
Software applications have been a key tool for businesses for decades, but the way they are designed and operated has changed during the past few years.
Story image
Artificial Intelligence
ForgeRock releases Autonomous Access solution powered by AI
ForgeRock has officially introduced ForgeRock Autonomous Access, a new solution that uses AI to prevent identity-based cyber attacks and fraud.
Story image
Secure access service edge / SASE
Versa Networks recognised as SASE leader in Govie Awards
Versa Networks has announced its SASE offering has been recognised in The Govies Government Security Awards competition by Security Today magazine.
SonicWall
Find out how you and your business can prevent being caught out by everything from ransomware to cryptojacking.
Link image
Story image
Cybersecurity
A10 Networks finds over 15 million DDoS weapons in 2021
A10 Networks notes that in the 2H 2021 reporting period, its security research team tracked more than 15.4 million Distributed Denial-of-Service (DDoS) weapons.
Story image
Tech job moves
Tech job moves - Datacom, Micro Focus, SnapLogic and VMware
We round up all job appointments from May 6-12, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Phishing
Google reveals new safety and security measures for users
Google's new measures include automatic two step verification, virtual cards and making it easier to remove contact information on Google Search results.
Story image
Cybersecurity
HackerOne launches Attack Resistance Management solution
HackerOne has launched Attack Resistance Management - a new category of security solution that targets the root causes of the attack resistance gap. 
Story image
Cybersecurity
CyberArk launches $30M investment fund to advance security
CyberArk has announced the launch of CyberArk Ventures, a $30 million global investment fund dedicated to advancing the next generation of security disruptors.
Story image
Cybersecurity
Managed service providers: effective scoping to avoid costly vendor pitfalls
Managed security services are outsourced services focusing on the security and resilience of business networks.
Story image
VPN
Palo Alto Networks says ZTNA 1.0 not secure enough
Palo Alto Networks is urging the industry to move to Zero Trust Network Access 2.0 because previous versions have major gaps in security protection.
Story image
Microsoft
Apple, Google and Microsoft expands plans to get rid of passwords
FIDO Alliance says the world is closer to not relying on passwords after Apple, Google and Microsoft expands their support for a passwordless sign-in standard.
Story image
Surveillance
Genetec launches new enclosure management system for data centers
Genetec has released a new enclosure management solution that will give data centers the ability to secure, monitor and manage access to racks and cabinets remotely.
Story image
Fortinet
Fortinet sees 34% revenue increase in latest financial results
Fortinet has released its financial results for the first quarter ended March 31, 2022, seeing a total revenue increase of 34.4% compared to the same quarter last year.
Story image
Blue Prism
Blue Prism Desktop uses IA to defend against vulnerabilities
SS&C Blue Prism Desktop aims to help protect businesses against vulnerabilities, using a combination of security measures and intelligent automation tech.
Story image
Firewall
Sophos named Gartner Peer Insights Customers Choice for network firewalls
The company earned the highest overall customer rating among vendors with at least 150 verified customer reviews.
Story image
Cybersecurity
Companies rushing to secure print infrastructure
As the pandemic prioritised communication channels and the shift to remote work, IT departments fell behind in updating the security of print and IT infrastructure.
Story image
Appian
Appian awarded billions in damages against Pegasystems Inc.
Appian has been awarded USD$2.036 billion in damages against Pegasystems Inc as the result of a jury verdict in the Circuit Court for Fairfax County, Virginia.
Story image
Cybersecurity
Video: 10 Minute IT Jams - An update from IronNet
Michael Ehrlich joins us today to discuss the history of IronNet and the crucial role the company plays in the cyber defence space.
Story image
Cybersecurity
ThoughtLab reveals 10 best practices for cybersecurity in 2022
The benchmarking study reveals best practices that can reduce the probability of a material breach and the time it takes to find and respond to those that happen.
Story image
Training
Fortinet training edges toward closing cybersecurity gap
The Fortinet Training Institute has made significant progress in closing the cybersecurity skills gap, on track to train one million people by 2026.
Story image
Cybersecurity
Hard numbers: Why ambiguity in cybersecurity no longer adds up
As cybersecurity costs and risks continue to escalate, CEOs continue to struggle with what their investment in cyber protection buys. Getting rid of ambiguity becomes necessary.
Story image
Phishing
Developments in phishing and how to protect your business
Phishing, the practice of sending malicious emails to encourage users to perform actions that benefit an attacker, is a key security concern for modern businesses due to its prevalence and impact.
Story image
Data Protection
Managed Service Providers key to customer data protection
Frequent cyberattacks in the ASEAN region drive the demand for MSPs that can deliver purpose-built security solutions for SME customers.
Story image
Workato
Workato unveils enhancements to enterprise automation platform
"The extra layer of protection with EKM, zero-logging, and hourly key rotation gives customers a lot more visibility and control over more sensitive data."
Story image
Remote Working
How zero trust and SD-WANs can support productive remote working
The way people connect with applications and data has changed, users are remotely accessing resources that could be stored anywhere from a corporate data center to the cloud.
Story image
Hyperscale
SpaceDC partners with Aofei for data center sales in Asia
SpaceDC has partnered with Aofei Data International to sell Aofei's data centers, CDN and SDN in China.
Story image
Ransomware
Cybersecurity starts with education
In 2021, 80% of Australian organisations responding to the Sophos State of Ransomware study reported being hit by ransomware. 
Story image
Application Security
What are the DDoS attack trend predictions for 2022?
Mitigation and recovery are vital to ensuring brand reputation remains solid in the face of a Distributed Denial of Service (DDoS) attack and that business growth and innovation can continue.
Story image
Phishing
KnowBe4 celebrates reaching 50,000 customers worldwide
KnowBe4 has reached the milestone of 50,000 customers, adding nearly 2,500 in the first quarter of 2022 alone.
Story image
APAC
Odaseva expands in APAC and UK with more security features
Odaseva, a data platform for Salesforce, is establishing new headquarters in London as well as a new data center in India.