Jonas Thulin, security consultant at network security firm Fortinet, discusses the importance of maintaining the security of a business’ website in order to preserve the integrity of its brand identity and company data.
The days of the enterprise website serving as a static “billboard” are long gone. Now, websites are a valuable brand ambassador, and crucially, they are often also a channel to market and a conduit to the enterprise backend systems. In some cases, your site IS your business. Unfortunately, many South African companies still overlook the importance of effectively securing their websites.
A website’s greatest strength is also its greatest weakness – it is accessible to everyone. This makes a website a natural target for the cyber criminal, hacker or hacktivist. Compounding this challenge is the fact that competition and business goals may drive web developers and designers to push site updates without proper security testing.
Regardless of the reason for the vulnerabilities or the motivation of attackers, a compromised website has serious implications – loss of revenue, negative impact to a company’s reputation and theft of sensitive information such as credit card numbers and personal data.
In South Africa, most of the high profile hacks recently have been hacktivist-style attacks on controversial or high-profile organisations. We’ve seen the defacement of the AARTO and Department of Health sites, the hack of the SAPS informants’ database, and the hacking of the Johannesburg City billing system, among others. These are just the widely-known cases. Unless cases go to court or are publicised, corporates are not likely to draw attention to site breaches.
In many cases, it requires extensive and careful forensic work to determine the extent of the breach if a site has been hacked. It is for good reason that hackers use the phrase “you’ve been owned” when they breach website security. Since most websites are connected in some way to multiple enterprise systems, there is a good chance that access via the website has allowed access to these systems. As a rule of thumb, enterprises should consider all their systems potentially vulnerable once their site has been touched.
Image courtesy of Shutterstock
