If you run an online business it’s likely you’ve been attacked once or twice. From a DDOS (distributed denial-of-service) to a mySQL injection, the longer your website has been online the greater of a chance it has at becoming a target to evildoers. This week one of my good online friends went under attack and I’ve been providing him with some tips to get things back up and running. The best way to protect your business from an attack is to be proactive.
First you need to understand WHY someone may attack your website. A “hacker” or someone that performs a cyber attack on your server always has an objective. Some want to gain access to your server so they can phish others want to send out SPAM using your mail server. Others do not like you and simply want to see you crash and burn. By understanding the type of person that wants to attack your website provides you the ability you need to seek to ensure protection.
Back in the early 2000s I owned a web hosting company. Unfortunately dealing with attacks was a daily occurrence for me. There was always a website or server that was getting hit for various reasons. The first thing I noticed was that sites that are controversial and discuss topics such as politics or religion were ones that got hit first. If you own a site that falls into one of these categories then you should take a VERY proactive approach to an attack.
The first step to preventing an attack is to ensure you’re running up-to-date software. A few days ago I posted an article on how you can keep your WordPress installation secure. Bulletin board software such as PHPBB is also an easy target for attackers. Every week you should perform an audit on your server and ensure every piece of software you’re running is 100% up-to-date. If you’re not using something then make sure you fully delete it. Leaving unused and unsecure files on your server can place a target on your web server.
Next you need to make sure the operating system on your web server is hardened. By default most web servers do not have very good security. If you have a good web host they will do this hardening for you free of charge. I know my web hosting company did this if a customer requested it and we would install several modules to ensure optimal security. You also want to do things like change the port of SSH/FTP and limit the IP addresses that are allowed to connect to your server.
With your software up to date and operating system hardened that doesn’t protect you against distributed denial-of-service (DDOS) attacks. These are designed to flood your website with “traffic” so the website begins to lag and eventually crashes the CPU. A DDOS attack can be hard to control at first because you have to be able to separate the fake traffic from your real visitors. Over the years this has became easier to prevent as more companies have came out with software and technology to help protect you.
One of the more affordable tools that protects on a DNS level (before the traffic hits the server) is called CloudFlare. For a couple hundred bucks a month they offer the ability to scan your traffic before it enters the site to make sure you’re getting real visitors and not fake traffic that’s sent to take you down. There are some other solutions out there that you can Google but some are quite costly as at times you may find the need to connect physical hardware to your server to mitigate an attack.
Ensuring your online business is secure is a must of anyone. If you’re a small business and don’t want to hire a systems administrator then I suggest at least taking time out weekly to audit your machine, make sure everything is up to date, and have your operating system hardened. Also consider preventive solutions such as CloudFlare to ensure you’re safe from attacks. Being proactive today is going to be much easier than being reactive tomorrow!