The Website Security And How To Improve It

Understand Website Security And The Practices To Improve It

Are you confident that your website will never be hacked?

In fact, a lot of people don’t bother with website hacking. Until they were hacked, they were startled, it was too late. Therefore, if you want to relax and focus on business, you should know the fundamental of website security.

Some Useful Ways To Secure The Website

Regularly update website application software

It seems obvious that making sure all software is up to date is important in keeping your site safe from ever-present dangers. This can apply to both server operating systems and any software you are running on a website including CMS or forums. When a website security vulnerability found in application software, hackers will take the opportunity to quickly try to misuse them.

If you are using an archiving management solution, you don’t need to worry about applying security updates to the operating system. Because the privileged company will help you manage this.

If you are using third-party software such as a CMS or forum, you should ensure that you already own another security version. Most of the product vendors have a newsletter or RSS feed that outlines any related website security issues. WordPress,  OpenCart, and many other CMS will notify you of available system updates every time you log in.

Make sure you keep up to date with dependent features and use tools like Gemnasium to receive automated notifications when a vulnerability is published in one of your website components.

SQL injection security

SQL injection is the most common form of website attack based on website form manipulations. The reason is that the content does not properly code and hacking tools take advantage of these weaknesses to sabotage activities.

This type of exploit is very easy to achieve even the inexperienced hackers can take this action. More seriously, if this error is made by skilled hackers, just a weakness in the source code website can reveal root access to web servers. And from there, hackers can attack other network servers.

Structured Query Language (SQL) is an almost universal database language that allows data storage, manipulation, and retrieval. Databases using SQL include MS SQL Server, MySQL, Oracle, Access…

And of course, these databases are also subject to SQL injection attacks. Antivirus programs are also not very effective at blocking SQL injection attacks.

Simply because they are used to detect and prevent a completely different type of data.

The most common way to prevent SQL injection is made up of two components. The first is to regularly update and patch all the servers, services and applications. Then produce and use the source code well. At the same time, testing the source code of the website does not allow any abnormal signs.

Secure website with XSS

Offensive cross-site scripting (XSS)

Offensive cross-site scripting (XSS) or attack malicious JavaScript on your site. Then runs in the browser of the user and may change site content or steal information to send back to the attacker.

For example: if you display comment on a page without validation, an attacker can send a message containing script tags. And JavaScript can run in every other user’s browser and steal their login cookie. Their login, thus allowing an attacker to take over the account of every user who saw the comment.

You need to make sure that users cannot put JavaScript content into your active pages.

This is of particular interest in modern web applications, where pages are built primarily from user content and in many cases generate HTML. Then also handled front-end like Angular and Ember.

These frameworks provide a lot of XSS protection. But combining communication between the server and client access can sometimes create more complex new attacks.

Not just integrating JavaScript into HTML efficiently, you can also insert source code content by inserting Angular or Ember commands.

The key here is to focus on user-generated content that can escape the boundaries you expect and be interpreted by the browser as another aspect you are planning. This is similar to protection against SQL injection.

When dynamically generating HTML, use explicit functions to make the changes you are looking for.

For example: using element.setAttribute and element.textContent, rather than manually setting element.innerHTML manually.

Or use functions in frameworks that run automatically rather than concatenating strings or setting up HTML content.

Content Security Policy (CSP)

Another powerful tool in the XSS Defender’s toolbox is Content Security Policy (CSP).

CSP is an attribute that your server can return to the browser to limit how JavaScript is executed in the website.

For example: do not allow to run any scripts that are not hosted on your domain; do not allow JavaScript inline or disable eval() function. This makes it more difficult for hackers to work. Even if they can be included in your site.

Improve Website Security with website error messages

Be careful with the information you display in error messages, providing only minimal errors to users to ensure that there is no secret leak on your server (for example, API or database password).

Do not provide complete exception details because these can make complex attacks like SQL injection easier. Store detailed errors in your server logs and only for people. Use the information they need.

Prevention and handling of DDOS attacks

DDOS are attacks that use many satellite computers to attack the server with the purpose of overloading the server to prevent the transmission of information, connection quality and access to your website.

Although DDOS attacks do not steal data or damage the structure of the website. It also brings a lot of disadvantages and difficulties when encountering.

So, for DDOS, you need to prepare in advance and have a plan that can be implemented immediately.

Approve/validate server-side website security

Validation must always be done on both the browser and server side. The browser can catch simple errors such as mandatory fields that are not blank, or when you enter text into numeric fields.

However, sometimes, they can be ignored and you should make sure to check these assertions.

Failure to do so could result in malicious code being inserted into the database. May cause unwanted results in your site.

Set a high-security password for website security

Everyone knows they should use complex passwords, but that doesn’t mean they’re always ready to do so.

It is very important to use strong passwords for the server and website administration area . But also to emphasize good passwords for your users to protect their account security.

Enforcing password requirements such as a minimum of about eight characters, including a letter and a capital letter, will protect their information from the long term insecurity.

Passwords should always be stored as encrypted values. Rather than using a one-way hashing algorithm like SHA. Using this method means that when you authenticate users, you only need to compare the encrypted values.

In the event that someone enters and steals your password, using a hashed password can help limit the damage because it’s hard to decipher.

Besides, you also set a two-layer password for all your online tools.

Such as: email accounts, hosting accounts, and website administration accounts.

Consider uploading files to the website

Allowing users to upload files to your site can pose a risk to website security. Even if a small change in their avatar is required.

The risk is that any file uploads may contain a script that is executed on the server that links to your website.

If you use a form of file download, you need to know how to manage all files. If you allow users to upload images, you cannot rely on image extensions or mime types to verify that the file is an image.

Because they can be easily tampered with, even opening the file or using the functions to check the image size is not sufficient evidence base.

Most of Image format allows storing a description that may contain source code made by the server.

Secure the website from downloading files?

The proposed solution is to prevent direct access to uploaded files together. This way, any file uploaded to your site needs to store in a directory outside the webroot or in a database in the form of blob.

If your files cannot access directly, you will need to create a script to fetch files from its own directory and bring them to the browser.

The image tag that supports the src attribute is not a direct URL to the image. So your src attribute can point to a file distribution script that gives you the right content type in the HTTP header.

Make sure you have a firewall setting and block all unnecessary ports. If possible, set up a DMZ that only allows access to ports 80 and 443 from the outside.

If possible, manipulate your database on a different server than your web server. This means the database server cannot access directly from the outside, only the server. Your website can access, and reduce the risk.

Lastly, don’t forget to restrict access to your server.

Secure with HTTPS

HTTPS is a protocol that provides security over the Internet. HTTPS assures users that they are interacting with the expected server and that no one else can block or change the content they are viewing.

If there is anything that users want privacy, you should only use HTTPS to distribute it.

A login form will usually have a cookie set, sent along with every other request to your site that the user logs in to and used to authenticate those requests.

Hackers will be able to perfectly imitate users and thereby take over their login session.

To counter these types of attacks, use HTTPS for your entire website. It’s no longer as difficult and expensive as it used to be.

In addition, Google has announced that they will increase the search ranking of the website if you use HTTPS, which is completely beneficial for SEO.

Website Security Tools

Once you think you’ve done everything you can, you should take the time to conduct website security testing. The most effective way to do this is through the use of some website security tools.

There are many commercial and free products to help you do this. They work on the same basis as the scripts that hackers use to check all exploits and try to hurt them. Harm your site using some of the previously mentioned methods like SQL injection.

Some notable free tools

• Netsparker (free version and paid version) is good for testing SQL injection and XSS.
• OpenVAS, is the most advanced open source security code scanner. It’s good for checking vulnerabilities. But it is difficult to set up because requires an OpenVAS server to install. OpenVAS was part of Nessus before it become a closed source commercial product.
• io (free online check), a tool to quickly report website security (such as CSP and HSTS enabled or as configured an exact domain name…).
• Xenotix XSS Exploit Framework, an OWASP (Open Web Application Security Project) tool, includes a series of XSS attack examples that you can quickly confirm if site input is vulnerable to Chrome, Firefoxand IE or not.

The results from the tests can be confusing for us because they present so many potential problems. It is important to focus on the important issues first.

Each reporting problem is often accompanied. With a good explanation of potential vulnerability, you may find that some low-level issues are not a concern for your website.

If you want to take it a step further, there are some next steps you can take by changing the POST/GET value. Because it allows you to intercept the values ​​of HTTP requests between your browser and server. A popular freeware application called Fiddler is also a wise decision.

Hopefully, the above tips will help keep your website and information safe. There are many CMS with website security features available. But the good idea is that knowledge of common security gaps is required to proactively protect your own website.

Thank you for reading!