The Evolution of E-Commerce amidst Rising Security Concerns

The many competitive advantages of ecommerce cannot be taken lightly. Offering online business and consumers alike a far improved productivity, significant reduction in costs, access and entry into a global business market, ability to provide a much improved customer service and streamlining business processes; are all reasons for brick and mortar businesses to open up their virtual shop.

Online shopping is a phenomenon that is growing rapidly, providing untold convenience and easy access to businesses and consumers alike; but the taint of unsafe credit card security and online fraud is steadily and adversely affecting their bottom line.

How can online business save their legitimate customers and themselves from this concern?

The Common Issues Experienced In Running an Online Business

One of the most common concerns that online retailers and merchants face is that they don’t know how to differentiate their legitimate customers from fraudulent users and hackers in real time. This concern follows with, not possessing an adequate security system that can help in detecting and minimizing online payment fraud, and lastly, not having an effective program that prevents unauthorized access to the data stored in a company’s network.

Potential Risks as an Online Business Operator

While there are many risks involved with the running of an online business, 3 major and potentially serious risks can sum up the entirety of this issue. These are:

Security Risk

Such risks are the cause of attacks from hackers and viruses and the severe of the damage incurred from the attack varies based on the type of attack such as; data loss, denial of service, stolen information etc.

Such attacks can bring a severe disruption to your business operations, which will automatically result in a drastic loss of customer confidence and your sales revenue.

Payment Risk

This issue normally occurs when the identity of the customer cannot be established or verified at the time of transactions taking place over the web. As a result, payment disputes significantly increase from genuine customers.

Although more commonly associated with customers paying over the internet via a credit card, other reasons may be; ordered goods not reaching the customer, a disagreement over the conversion rate, and finally, the goods and services being of the same quality as the customer’s expectations.

Fulfillment Risk

This term means delivering goods safely to the customer and can be either a digital product or a physical one. The risks that are related with the delivery in goods and services are; defective goods, a significant delay in delivery, and the goods delivered not matching with the description given etc.

Digital goods fulfillment is prone to risks as well. Performed through an electronic medium, it’s very much vulnerable to hijacking, mass duplication of copy-righted content and illegal manipulation and handling of information content.

How Can Online Business Operators Minimize These Risks?

As much as ecommerce helps online businesses, in order to save yourself and your customers from all these risks and more, business owners can adopt and implement a number of network security services and solutions that will help immensely.

Cloud Guardian, a managed web-hosting service provider has on offer cloud based security services which significantly improve efficiency of the business owner when it comes to quick and easy management of the services offered by the site. Moreover, the web application penetration service detects suspicious activity and deals with it before any damage is done.

Want to know more about our services? Visit our website today!

Amazon AWS Security Risks

Amazon AWS provides a great opportunity for the companies to reduce the costs in their IT infrastructure and increase the speed they can release their products to the market. Amazon AWS contains a large number of resources, such as Infrastructure-as-a-Service (called EC2), file storage (S3 buckets), Database-as-a-service (RDS) and many others. The number is growing every day and the value increases significantly. Almost all startups and companies now consider Amazon AWS to host their IT infrastructure.

To make an appropriate decision to use Amazon AWS cloud or not the companies need to fully understand the risks introduced by using this technology. The risks landscape is very different from traditional IT infrastructure, when all the critical system and applications are located behind the corporate firewall in internal network. Now the infrastructure located in the Cloud and requires different protection.

Below are the common risks introduced by the adopting Amazon AWS Cloud:

1. Unauthorised access to the Cloud Management Console.

   Description: The administrator or Amazon AWS Account owner has full control over the cloud resources. He or she can delete all the servers just by clicking the button. If the administrator is not fully understand the technical background, he or she can open the firewall rules to allow all the traffic going in and out of Amazon AWS account. The hackers can potentially brute force / guess/ steal the password and connect to the console. If a hacker gets control over the account, the availability and integrity of the systems can be affected.

   Risk: High
   Likelihood: High (by default the account is protected by only password)
   Impact: High (all the servers can be affected)

   Mitigation controls: Amazon AWS can provide additional protection for an Amazon AWS account: two factor authentication. The administrator can use their mobile phone with Google Authenticator installed to increase the security of the account. Two factor authentication is not enabled by default and requires additional configuration.

2. Poor access management process.

   Description: The Amazon AWS Management console is available from anywhere in the world. Obviously it provide a great flexibility for the users, but also presents a huge risk. If a company doesn’t have strong access management process, the terminated employee will probably still have access to the console. He or she will be able to connect from home, internet café or even competitor. Many companies have Identity and Access Management (IAM) system implemented for their internal systems, but Amazon AWS console not always integrated with it.

   Risk: High
   Likelihood: Almost certain (if a company has a large number of users)
   Impact: High (terminated users may cause significant damage)

   Mitigation controls: The companies need to review the users on the regular basis. It may be difficult the one company has multiple Amazon AWS accounts as Amazon doesn’t provide centralised console at this stage. Another option is to integrate Amazon AWS with IAM system or Active Directory, but it requires significant investment.

3. Weak firewall rules.

   Description: By default, when you create an Amazon EC2 instance the Amazon will propose the default firewall rules (Amazon calls them the “security groups”) to access the instance. For Linus based instances it will be port 22 (secure shell) and probably ports 80 and 443 for the web server. For Windows instances they will be port 3389 (Remote Desktop) and ports 80 and 443 for the web application. By default, all internet will have access to this ports (source is 0.0.0.0/0). The hackers will probably try to brute force the password for SSH or RDP or use known exploit to get in.

   Risk: Medium
   Likelihood: Almost certain (not many people change the default rule set)
   Impact: Medium (the SSH access by default is configured to use private/public key and Windows password is relatively strong)

   Mitigation controls: The administrators or security professionals need to constantly audit the firewall rules to make sure the remote access is configured for particular source IP addresses. The IP restriction will reduce the risk of compromise significantly.

The above risks are just an example of what the companies should look at when adopting Amazon AWS cloud. The internal security department or systems administrators should perform the comprehensive security assessment of the environment before putting critical application into the cloud. If a company doesn’t have necessary skills to do it “in-house”, Cloud Guardian will help. Cloud Guardian staff will perform the risks assessment of your environment, propose the best mitigation controls and integrate them with our monitoring system to make sure your environment is safe. Moreover, we’ll help you to secure all your Amazon AWS accounts from single interface. Contact us for more details.

Enjoy AWS Security like Never Before

If you want to secure your Amazon AWS accounts, Cloud Guarding is where your search ends. As a unique tool performing Amazon AWS risks assessment, Cloud guardian not only monitors changes across multiple Amazon AWS accounts but also manages multiple Amazon AWS accounts.
This way Cloud Guardian allows users to have absolute control over who is granted or denied access to their Amazon AWS accounts. Cloud Guardian also facilitates the security groups by ensuring that they are configured properly and ensures that all instances of a cloud are well protected.