The past eighteen months or so have been incredibly trying for business
Some had to close their doors and facilitate remote working for their employees, pushing through unfinished digital transformation strategies to make it happen as quickly as possible. In something McKinsey has now dubbed The Quickening, some businesses actioned a decade’s worth of digital change in the space of 90 days as they set out to navigate their way through the pandemic. Developing technology around distributed working at breakneck speeds might seem impressive, giving many businesses a cause for celebration, but such rapid gains rarely come without a few cut corners – unintentional as they may be.
As businesses discover the benefits of distributed working, is there a risk that some may have developed blind spots in their security? According to a 2021 survey conducted by PurpleSec, cybercrime as a whole has increased by a staggering 600% since the beginning of the pandemic. Could this be because attackers are aware of how rapidly businesses are adapting to circumstances, potentially leaving themselves vulnerable to a security breach? Since the start of lockdown and increased remote working, websites have become one of the main vectors for cyberattacks, so it’s never been more important for businesses to have robust security policies regarding their customer data and the handling of digital content.
An organisation’s Content Management System (CMS) can be a potential weak spot at the best of times, so careful attention should be paid to it now from a security perspective. A CMS breach can threaten business continuity and bring even the largest corporations to their knees within hours, so building a strong and reliable underlying infrastructure on which to build your CMS has never been more important. In order to better understand these risks and what can be done to mitigate them, let’s take a look at some of the more common CMS-related security breaches.
Brute force attack
A brute force attack is, as its name suggests, a relentless bombardment of trial and error that seeks to break down your CMS’ defences by guessing every possible combination of username and password to bypass the admin login. Brute forcing is old school for sure, but it’s still a threat and current technology allows hackers to guess an unfathomable number of combinations in a relatively short space of time.
DDoS attack
A distributed denial-of-service attack is a malicious attempt to disrupt normal traffic to your website, often overwhelming it with requests that stop it from functioning properly. Online retail stores are commonly hit by DDoS attacks, effectively bringing their business to halt as their website becomes overwhelmed. According to data from Kaspersky, there was a spike in the number of DDoS attacks in January 2021, and they accounted for more than 43% of all attacks in that particular quarter.
Cross-site scripting attack
Often called XSS attacks, they refer to the injection of malicious code to otherwise well-trusted websites, which can then slip by users’ browsers unnoticed and infect their machines. These scripts are capable of rewriting the content of an HTML page, as well as accessing sensitive information such as cookies and browsing history.
File inclusion exploits
File inclusions are a common server-side scripting language used in websites. They are what keep web application code tidy and maintainable. They also allow web applications to read files from the file system, provide download functionality, parse configuration files and do other similar tasks. If not implemented properly, attackers can exploit them and craft an LFI attack which may lead to information disclosure, cross-site-Scripting (XSS) and other potential attacks.
In order to protect itself from such attacks, your business needs to be sure to keep its CMS updated constantly, now more than ever. As part of the regular update and maintenance process, your business should also keep regular data backups in the event of an attack in order to preserve business continuity. Of course, prevention is always better than cure, so be sure that your organisation spends plenty of time reworking its security protocols in line with its new remote or hybrid working parameters.
Having a resilient underlying infrastructure in place for your CMS has never been more crucial than it is today, but that can only happen with the right amount of planning, and with due time being given to even the most basic security policies – from passwords to the inclusion of SSL certificates.
About the Author
Neville Louzado is Head of Sales at Hyve Managed Hosting. We combine small team ethos with a passion for technology and support by providing fully managed, global cloud hosting services. As certified Google and Equinix partners, we are expertly positioned to power your success.
Featured image: ©Amgun
