Cyber security considerations for small and medium size businesses.

1. www.ebusinessmantra.com
Presented at UMass Dartmouth
Charlton School of Business
eCommerce Conference
April 24, 2015
eSecurity
1

2. www.ebusinessmantra.com
About ebusinessmantra
 Web Application Development (Java and .NET platform)
 Web Application Security Consultant
 Develop security strategies for web sites
 Find vulnerabilities in clients’ web sites
 Offer security products and services
2

3. www.ebusinessmantra.com
Agenda
 (In)Security Landscape
 How does it matter to S&MB?
 Why are web sites vulnerable?
 Getting inside the mind of a hacker
 How to minimize risks
 Discussions/Q&A
3

4. www.ebusinessmantra.com
Cyber Attacks – War Games
 map.ipviking.com
4

5. www.ebusinessmantra.com
Cybercrime Is a Fact of Life
Governments
Businesses
Organized Criminals
Individuals
5

6. www.ebusinessmantra.com
High Cost and Losses
6

7. www.ebusinessmantra.com
2014 Data Loss
• 3000 reported incidents
• Over 50% involved businesses
• 1.1 billion records exposed
• Over 83% of data breaches due to hacking
7

8. www.ebusinessmantra.com
We are Small Business…
Small & Medium sized businesses are most vulnerable because
they don’t have resources that large organizations have
Vulnerabilities in your business web site could be exploited to
distribute malware
Business Partners’ web sites may be compromised and
distributing malware
70% of web sites are vulnerable to hacking
8

9. www.ebusinessmantra.com
Why are Web Sites Vulnerable?
• Attack passes as normal traffic through ports 80 & 443
• SSL, Network, OS securities cannot protect web applications
9

10. www.ebusinessmantra.com
Web Site Vulnerabilities (OWASP Top 10)
Injection
BrokenAuthentication and Session Management
Cross Site Scripting
Insecure Direct Object Reference
Security Misconfiguration
Sensitive Data Exposure
Missing Function LevelAccess Control
Cross Site Reference Forgery
Using KnownVulnerable Components
Unvalidated Redirects and Forwards
10

11. www.ebusinessmantra.com
Getting Inside hacker’s mind
Reconnaissance Discovery
Attack
11

12. www.ebusinessmantra.com
Hacking Tools
12

13. www.ebusinessmantra.com
Hacking Tools
Google Hacking Database
13

14. www.ebusinessmantra.com
Google Hacking Database - Example
Configuration File
14

15. www.ebusinessmantra.com
How to Minimize Risk
Security
Monitor
Engage
Security Expert
Awareness and
Recognition
15

16. www.ebusinessmantra.com
Security Monitoring
 Periodic Web Site Scanning for Vulnerabilities
and need to fix them
 Web Application Firewall
 Real time, continuous protection
 Set policies to alerts and/or block attacks
 Virtual patch from scanning results
 Block traffic from certain region
16

17. www.ebusinessmantra.com
Take Away
Threats are real. Security is an continuous
process and not an add on or something
nice to have.
17

18. www.ebusinessmantra.com
PCI Requirements for Credit Cards
18

19. www.ebusinessmantra.com
PCI DSS Requirements – web related
Reviewing public-facing
web applications via
manual or automated
application vulnerability
security assessment
tools or methods, at
least annually and after
any changes
Requirement 6: Develop and maintain secure systems and applications
19

20. www.ebusinessmantra.com
Google offers the widest threat surface
www.pcworld.com/article/227352/attackers_use_google_images_to_distribute_malware.html
20