Friday, February 2, 2024
Sunday, June 10, 2018
ECommerce Platforms
In this post, we will deal with e-commerce. Which are the most popular and secure ecommerce platforms? What is needed to secure them?
E-commerce is selling and buying goods and services from the internet and paying through this medium. This transaction happens between clients to business, B2B, client to client. As in between all this, there are money transactions which we should be cautious when using, or setting up e-commerce websites.
Some of the top e-commerce platforms which are secure as well are listed below along with a detailed explanation about them.
Magento
The website link is – https://magento.com. This platform is one of the best and is developed by eBay. Magento can be easily integrated with the PayPal gateway. It has two versions– Free Version and Pay Version. The vulnerabilities are patched too fast .It has a vast variety of plugins and customization. It has SaaS solutions, which means Elastic scalability, high resilience and availability, PCI compliance, global availability and automated patching, while still maintaining flexibility in software customization that our merchants require.
Shopify
The website link is – https://www.shopify.com, so if you are trying to design the checkout page to be exactly how you want, Shopify is probably not for you. In fact, none of the hosted solutions will offer customizable checkout process, so you can jump the Self-Hosted section right away. Shopify has many apps that you can download and install on your store, which extend the default features or introduce new functionalities.
Woocommerce
The website link is – https://wordpress.org/plugins/woocommerce/. WooCommerce is a free e-commerce plugin that allows you to sell anything very practically. Built to integrate seamlessly with WordPress, WooCommerce is the world’s favorite e-commerce solution. It gives you both store owners and developers complete control that use WordPress templates.
With endless flexibility and access to hundreds of free and premium WordPress extensions, WooCommerce now powers 30% of all online stores, more than any other platform.
Bigcommerce
The website link is - https://www.bigcommerce.com. It has over 115 e-commerce templates, unlimited product uploads, mobile view, it is perfectly integrated with amazon and eBay. It also can be integrated with most of the payment gateways. From security perspective, it is PCI compliant.
How To Choose A Web hosting For A Website
When choosing a Web hosting company one of the main key indicators is to see their client’s satisfactory reviews and the price which is also important. As technologies and hosting industry changes too often and fast for an expert, we should be aware to check with following criteria’s.
Server Reliability / Uptime Scores – The most important point to know here is whether they have a 24×7 operating web host. You need a web host to operate on a powerful server and have stable network connections. Close to 99.5% and above is the recommended uptime score; anything below 99% is unacceptable.
A company that supports Multiple Add-on Domains.
Price of Hosting Signup and Renewal Cost. Hosting deals and shared hosting especially are normally selling very cheap on signup prices, but charge much higher on renewals.
What Refund Policy they are offering? – If you choose to cancel your host within the trial period, what are the implications? Does the company provides a full money refund? What is the hosting company’s refund policy after the trial session? Are there any cancellation charges?
Easy to use Hosting Control Panel. A user-friendly and functional hosting control panel is very important.
Account Suspension – What are the limitations? Here’s a money tip that most hosting review sites will not tell you – Hosting companies will pull the plug and suspend your account if you are using too much CPU power (yes, unlimited hosting is limited) or violating the rules.
Do they offer Backup. Are they free of charge?
Do they have 24/7/365 Live Chat Support.
Choose a Web Hosting Plan
Before choosing the right hosting plan, you should know what you need, a Windows OS based hosting or a Linux OS based hosting. This choice depends on the coding language that your website has. If it is ASP, it should certainly be a Windows based hosting and should also have an IIS server installed in it. If it has any other programming languages like PHP, Perl, Ruby, then you should go with Linux based hosting.
After you have decided on the type of hosting (Windows or Linux), you should define the right hosting plan.
You should take into consideration the following factors −
Disk Space
Bandwidth
Number of Hosted Domains
Number of Subdomains
Parked Domains
Versions of PHP, MySQL and Perl.
The main plans in general are as follows −
Shared Hosting
It is the most basic plan that every hosting provider offers. Shared hosting is fundamentally many hosting accounts located on one server. Some of them share the same IP address (although a dedicated IP address is often available for an additional fee). This plan will always offer a specific set of features and will always have resource limits. If you are not certain, then it will be better to start with a limited plan and later upgrade it after the website grows and gets more traffic.
VPS Hosting
VPS is a Virtual Private Server. This refers to the partitioning of a physical server into multiple servers where each one acts just like a dedicated server, each has its own operating system and can be rebooted separately. These operating systems receive a specific share of the resources of the physical server and they are isolated from each other. There are two types of VPS hosting −
Managed − Managed means that the patching is done by the hosting company by offering a CPanel in it.
Unmanaged − Unmanaged is a hosting where you should take care of your VPS in everything and there is no CPanel in it.
Dedicated Hosting
This is the most powerful type of hosting, which meets the requirements and needs of big businesses. Dedicated server owners can sell hosting services for a profit. They can choose the server specifications and environment. If you have heavy traffic, a very popular site, or a large customer database, then consider Dedicated Hosting. A dedicated server also provides more freedom to send emails and stream media.
TIPS − The most important thing in hosting is to check prices of different Hosting Companies and their hosting plans prices with comparison websites for a better understanding. An example of a comparison website for checking prices of hosting companies is – http://www.hostmonk.com/.
Guide On Website Development Security
Securing your webpages is as important as developing it, because any threat which can compromise the security can harm your business reputation, damage you financially (by stealing your online deposits), damage your clients that visit your website, etc.
As per security experts, they will suggest to do the website security check based on the OWASP TOP 10, which is a powerful awareness document for web application security. The OWASP Top 10 represents a broad consensus about what the most critical web application security flaws are.
SQL Injections
Injection flaws, such as SQL, OS and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or a query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
Solution − To secure your webpage from iSQL, you must validate inputs and filtering symbols.
Broken Authentication and Session Management
Application functions related to authentication and session management are often not implemented correctly, which allows attackers to compromise passwords, keys, session tokens or even to exploit other implementation flaws to assume other users’ identities.
Solution − To secure your site from this flaw, you must make cookies and sessions with expiration time.
Cross-Site Scripting (XSS)
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser, which can then hijack user sessions, deface websites or redirect the user to malicious sites.
Solution − Protection from this is on the same lines as it is for iSQL.
Scripting
Insecure Direct Object Reference
A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory or a database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
Solution − You should implement specific protection mechanisms such as passwords to safeguard such files.
Security Misconfiguration
Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server and the platform. Secure settings should be defined, implemented and maintained, as the defaults are often insecure.
Solution − Software should be kept up to date.
Sensitive Data Exposure
Many web applications do not properly protect sensitive data, such as credit cards, tax IDs and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft or other crimes.
Solution − Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
Missing Function Level Access Control
Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests to access functionality without proper authorization.
Solution − You should check the levels of authentication.
Cross-Site Request Forgery (CSRF)
A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests which the vulnerable application thinks are legitimate requests from the victim.
Solution − The most commonly used prevention is to attach some unpredictable challenge based tokens to each request that comes from a website and associate them with the user’s session.
Using Components with Known Vulnerabilities
Components, such as libraries, frameworks and other software modules almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts.
Solution- Check if that component version has vulnerabilities and try to avoid or change with another version.
Invalidated Redirects and Forwards
Web applications frequently redirect and forward users to other pages and websites. These applications use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites or use forwards to access unauthorized pages.
Solution -Always validate a URL.
Secure Used Protocols
This is the case where you have a VPS plan and you manage everything on your own. When the services are installed they use default ports. This makes the job easier to a hacker because he knows where to look at.
Some of the main service ports which are used in hosting of websites are given below-
SSH – port 22
FTP – port 21
MySQL – port 3306
DNS – port 53
SMTP – port 25
The port changing of those services varies depending on the Operating System and its different versions. In addition to this, you have to install a firewall. If it is a Linux OS, we will recommend IPtables and block all the other unneeded ports. In case your OS is Windows, you can use its incorporated firewall.
To block brute force logins in your services, you can use Fail2ban, which is a Linux based software and block all the IP addresses which makes many failed login attempts.
Subscribe to:
Posts (Atom)