Bolstering eCommerce Website Security: Easy Steps to Safeguard Against Breaches

Below are a number of simple things that Foregenix recommend be performed on a regular bases in order to help mitigate breaches:

1.   Regularly check the framework providers for software updates or patches - if critical security patches are announced, install them within one month (sooner if possible):

• Magento versions/patches can be monitored here: https://experienceleague.adobe.com/docs/commerce-operations/release/notes/overview.html?lang=en
• Wordpress vulnerabilities can be monitored here: https://wpscan.com/wordpresses
• Wordpress versions can be monitored here: https://wordpress.org/news/category/releases
• Cs-Cart versions can be monitored here: https://docs.cs-cart.com/latest/history/ index.html 
• Drupal versions can be monitored here: https://www.drupal.org/project/drupal/releases 
• OpenCart versions can be monitored here: https://www.opencart.com/index.php? route=cms/download/history

While you might not be monitoring for security updates, I can assure you that attackers are.

2.   Implement a password policy that covers the following:

• Regularly rotate passwords - if you can, try and stick to a maximum of ninety (90) days between password changes.
• Accounts that have not been used within the last ninety (90) days, should be deactivated. 
• If an account is no longer required for an individual, deactivate it and remove it within ninety (90) days.  Sooner if at all possible.
• Ensure that the last four (4) passwords are not reused upon password resets.
• Monitor any third-party admin accounts in order to ensure they are used appropriately.
• Once any and all third-party accounts are no longer required, deactivate the account and remove it.

The benefit to monitoring accounts and changing passwords means you prevent stale accounts being available.

3.   Implement admin account restrictions:

• Ensure that only those employees who require a full admin account are provided one. 
• Ensure that the least level privileges required to complete the job is provided to employees.

The less permissions an account has, the harder it is for an attacker to gain the relevant access they need.

4.   Implement Multi Factor Authentication (MFA) on all admin user accounts:

• For Magento 2, please see - https://devdocs.magento.com/guides/v2.3/security/two-factor-authentication.html
• For Wordpress, please see - https://wordpress.org/plugins/wordfence/
• For OpenCart, please see - https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=32882

MFA is one of the most powerful tools in your arsenal purely because of the way a one time token is required during login.

5.   Record admin changes - There are a number of plugins out there that record when an admin user logs in and / or makes changes from within the admin area. As configuration parameters can be configured within the admin area it's good practice to record when changes are made.

• For Magento you can use - https://amasty.com/admin-actions-log-for-magento-2.html
• For Wordpress you can use - https://wordpress.org/plugins/simple-history
• Install a good security solution to scan the website for malware. 
• FGX-Web can be used to monitor and scan the website for malware and possible signs of threat across Magento, Wordpress, OpenCart, CScart, etc. 

The plugins referenced above are examples that provide the relevant functionality discussed above. There may be others out there and there may be articles online that compare different plugins so please research prior to installing.

You can also check - and monitor - your website security status using our free ThreatView Community service:

While a number of the recommendation made above may sound simple, they can be very effective in helping prevent an attack on the website. One of the sayings I tend to refer to when speaking to impacted customers is “you don’t have to outrun the bull, you simply need to outrun the person next to you”. It may sound horrible, but when you look at the statistics, attackers simply target those websites that are susceptible to vulnerabilities rather than trying to exploit the unknown. A lot of the time, the attackers will simply monitor the patch notes and security bulletins for frameworks like Magento or Wordpress and then scan the Internet for websites with those vulnerabilities and once detected, exploit them. By implementing a simple update policy that ensures critical security patches are applied within a month, you could be making the difference between your website being targeted or being left alone. 

If you think you might have fallen victim to a breach, do not hesitate to contact us here at Foregenix.