Protect your website
Many people build their website and think that their work is done. But the truth is your website needs constant security protection to keep running. The more popular it is the more likely it is to be hacked, have massive amounts of spam or require regular updating. Geek Friend can support you in designing and choosing the security plan that is right for you.
Why should I be concerned about online security?
There are three main reasons you should be concerned about the security of your online presence, and particularly that of your business or personal site.
On the Internet, one single criminal has the computing capacity to storm thousands of sites in a few seconds. This means that a relatively small amount of attackers worldwide are storming millions of sites everyday, and therefore, the chances of your site being attacked are high.
There are many valuable things in your site. First of all, your site has positioning power (an external site linked from your site gains a few points in Google rank). Secondly, your site has computing power since it is stored in a server (for example to send a few thousands of spam e-mails everyday). Finally, it is the perfect platform to propagate viral infections to your visitors and compromise their information (including their credit cards).
Internet is a globalized landscape, and this creates opportunities for Internet criminals. Let’s see this with an example.
The Wild Internet Landscape
If your business was robbed, most of the time you will know it. It will be clear that someone stole from you and compromised your clients. Naturally, you would report it to the police and insurance company. In the best case, a police officer takes down your information and starts to look for the perpetrator of the crime.
Now, let’s go to the 21st century version of robbery — cyber attacks. Imagine that your site is hacked and your clients receive dozens of spam emails. Geek Friend can track the criminal to a proxy server in South Africa, or China, or Russia, and the proxy owner refuses to share the server logs. In this case, the police cannot keep on looking for the criminal and charge him or her and the business owner is out of luck.
So, how do I protect my site?
Since in the Internet you cannot take advantage of public security (i.e. police), you need to protect your site, or have someone do it. Usually we consider our site being like a home or a small shop, but this not an accurate perception of it.
Even a small website has several dozens of components working at the same time to provide the required services (online presence, booking services, shopping services, etc.), and several hundreds of requests and visitors everyday. A more accurate picture of our site would be a big mall or an airport.
Security Layer I – Backing Up and Updating Your Website
The first set of security risks are a result of accidents and malfunctioning components. If something happens, your site will be down and your business activity may be damaged. In our airport model, it would correspond to a fire, accidents, etc.
The first layer of security measures should double. As in an airport, we want to keep all the protection systems up to date and functioning (fire alarms, control systems, response teams, etc.), and in case of an emergency, the services restored as soon as possible.
In order to achieve this, we update your website regularly (every week) and keep track of technology changes to prevent emergencies. In case of an emergency, we have regular backups of your site ready so that we can restore it immediately.
Security Layer II – Minimizing and Maximizing Existing Structure
In the first security layer, there is not any particular measure to prevent intentional damages against your site, just to keep it running and monitor it. This is why we offer a second security plan.
Before we enhance your site’s security, we check that there isn’t any threat to your site already. We scan every file thoroughly (airport personnel) and look up your database (airport policies and facilities).
Then, we consider carefully the services the site offers and deactivate those services which are unnecessary, or let go personnel and policies that are redundant; then we retrain and retool the remaining assets. In this case, Jetpack and Akismet are the official WordPress.com’s plugins to deal with security issues and spam.
Once we have finished refurbishing your site, we are ready to deploy the second security layer and take global measures to prevent any damage to your site. In terms of an airport, it would be like setting up a policy to restrict people with weapons, and other potentially dangerous requests. We get this by deactivating directory indexing and scripting requests in the server level.
Level III – Surveillance and Access Restrictions
The third security layer is related to surveillance and access restrictions. It means installing surveillance cameras and setting new policies about who has what security credentials and what facilities they can travel to in our airport.
The surveillance policy is accomplished by analyzing connection logs. With scalp (a security script ran locally), we analyze attack patterns and take the necessary measures (restriction on usually attacked directories and files). We also set access restriction policies.
Finally, access to the database (petitions to change policies and facilities) is severely restricted (only a few actions are allowed on it). In addition, we create a damage policy in case an attacker succeeds. For example, if a hacker gains administration privileges, file modifications are restricted.
Our final security step is to reset all security clearances (salt keys, users and passwords) in case an undetected attacker had them before. We crawl your site to verify every service is functioning normally. As an additional policy, we will reset your security clearances every one to three months.
Is there anything else I can do?
Those security measures really enhance your site’s defenses. Nonetheless, there are still a couple things we can do. The first one is to move your site to a server which provides you with an anti-virus process, and the second one, to set up an external service to scan any request to your site while it is being sent.
We provide these services to a number of clients. If you are interested in exploring further how you can protect your website, please feel free to contact us.