The Introduction

Websites can be compromised, even well-configured websites. It's important that websites are kept up to date, and use the latest security measures. It is also important that as a user of the Web, you should know of the common ways it can be compromised.

Social Networking or Phishing

The most common point of failure is usually not software, but people. I have always said that computers/servers only do what they are programmed to do. Sometimes bugs do happen but generally, the fault lies with people. Sometimes it's a person writing down their "super-secure password" on a sticky note and hiding it in their drawer. Sometimes it's mishandled information via email or phone conversation. People make mistakes, it's common, it happens, and a lot of times it's by accident.

It could even have been a "hacker" calling in and convincing a support tech that the person on the phone is someone else. If they do it well enough, then the "hacker" will get access to what they need. It's always good to come up with procedures for handling user content on the phone/email in order to reduce those events happening.

Security Patches

Patching holes in code is a necessary evil in today's world. Software and components have so many holes and bugs that can lead to a catastrophic failure of systems. You should check for updates and run them whether you are on Windows, Mac, or Linux. Windows especially since it is one of the major used operating systems that most of the world relies on so it is definitely more susceptible to attacks than Mac or Linux would be. Granted you do have to be lenient when operating in a corporate environment, you should always make sure that the updates won't break your system. That is a definite possibility and should be a constant concern. Like always though, backups backups backups.

Third-Party Code

Programmers are brilliant, but even among the best programmers, bugs can still happen. The most common form is plugins or addition to code. The more complex something is, the greater the risk of security holes. This is also where you could potentially experience a cross-site scripting (XSS) attack. This is where an attacker can inject malicious code into a website in order to steal information from the site users.

Bad User Security Policies

The common security policy would be account security for user accounts. Policies like security questions, strong passwords, Two Factor Authentication, and even physical token keys. Email verification is also very common, and easier to manage, but still prone to attacks. I would never suggest using a phone number as a good security measure. It is something but by far the easiest way to hijack. Whether it is the attacker grabbing a copy of your sim, or spamming your number until you get fatigued and answer incorrectly.

SQL Injection Attacks

This is where somebody goes to your website looking for any sort of submission form and they will try to parse code directly to your database connection in order to access information. They can input common expressions or commands in the hopes of pulling out data from your database. This is why your forms should always be sanitized as a precaution.

Data Leaks

Depending on how things are programmed, data can just leak out. URLs could contain sensitive information that then the hacker or malicious person could turn around and use against you. If you upload files and you didn't permit to protect them then they could download and use that data against you. If you didn't lock down your CMS platform somehow they got in. It's not always the result of poor programming either, sometimes accidents do happen.

Mouse Hi-Jacking

Mouse Hi-Jacking is where someone setups content that looks innocent enough, but when a user clicks around the website something malicious or something the user did not intend to do. Such as downloading a virus or redirecting to another website.

Denial of Service (DoS) Attacks

This is where an attacker overloads a website with traffic in order to make it unavailable to legitimate users. For website owners, a DoS attack can result in lost revenue, damage to their reputation, and the need to spend time and resources to mitigate the attack and restore access to their website. For users, a DoS attack can make it impossible to access the website or service, which can be frustrating and inconvenient. Additionally, a DoS attack can sometimes be a precursor to other, more serious attacks, such as data breaches or ransomware attacks.

The Conclusion

Nothing is ever foolproof. If someone wants to get to your data and they are driven, it's going to happen. There are always exploits in everything you use and you cannot plug them all. However, having the necessary tools and backups will go a long way toward recovery. Hopefully, by bringing this to your attention, you could be more aware of how you use the web.

Full Disclosure

Most of this article is comprised of facts and opinions. The featured background image was created by andyoneru and is available on Unsplash. I added a blur and a gradient overlay with text to convey for the post.