[gsingh21]

what preventative measures could be taken in order to stop websites from being hacked?

 

[LMiller7]

Are you hosting the website yourself?
If yes, there is much you need to do, the details of which would depend greatly on the situation. Otherwise it is primarily in the hands of the host.

 

[rrmagure]

There are many things that you can do reduce the risks of hackers get into a website Hackers tend to target web applications. This is because vulnerabilities in web applications such as poor coding make it easy for hackers to bypass authentication of users on the website. It helps to first have an understanding of common vulnerabilities in websites. According to the Open Web Application Project (OWAP), risks for business Web applications include
• Unauthorized access to resources
• Data leakage /improper handling of confidential data such as credit card numbers
• Broken authentication/ session management
• Insecure cryptographic storage
• Insecure commendations
• Failure to restrict URL access
• Cross site scripting
• Injection flaws
• Malicious file execution
• Insecure direct object reference
• Cross site request forgery (Harwood, 2011).
Here are some ways to reduce the above risks
• Educate end users and staff
o For instance, educate them about social engerring, being link wary, not opening unknown email attachments, and/or that the website will never ask them to email his or her log in credentials.
• Secure the site by hardening the network
• Use and implement firewalls, IDS, and anti-virus and anti-malware software
• Create and implement network security wide policies and procedures for employees
• Use encryption to protect the confidentiality of data
• Use error message storage
• Use permissions and active directory and group policy settings to limit users access according the principle of least privilege
• Use VPN and SSL protocols
• Keep firmware, operating systems, applications, and antivirus software up to date on a regular basis (Harwood, 2011).
Lastly, anther helpful tool is to use Nessus. This is a vulnerability assessment that includes a variety of tools such as port scanners. Furthermore, it also gives you solutions to fix vulnerabilities found in your network.

I hope this helps. Let me know if you have any questions.

Becky

References


Harwood, M. (2011). Information systems security & assurance series: security strategies in
web applications and social networking. Sudbury, MA: Jones & Bartlett learning