Malicious files and links regularly bypass security products, leaving many organizations vulnerable to web-based attacks including Ransomware, Phishing and data breaches like Emotet, Dridex, Maze, Lokibot, Wannacry etc. Organizations can enhance security against website attacks by following cyber security best practices like the implementation of a multi-layered security concept known as Defense-in-Depth.
Following the recommendations of the Cybersecurity and Information Security Agency (CISA) encouraging website administrators to review it’s updated “Tip on Website Security”, we are using this article as a public service educational piece with the hope that it will help those who manage websites for small organizations to take the necessary steps to protect against website attacks.
What is website security?
Website security refers to the protection of personal and organizational public-facing websites from cyber attacks.
Why should I care about website security?
Cyber attacks against public-facing websites—regardless of size—are common and may result in:
- Website defacement,
- Loss of website availability or denial-of-service (DoS) condition,
- Compromise of sensitive customer or organizational data,
- An attacker taking control of the affected website, or
- Use of website as a staging point for watering hole attacks.
These threats affect all aspects of information security—confidentiality, integrity, and availability—and can gravely damage the reputation of the website and its owner. (more…)