A guide to cyber security for e-commerce businesses – IT Governance UK Blog

If there’s one certainty about cyber crime, it’s that criminals are always looking to acquire sensitive data.

Whether you’re a small e-tailer with a handful of employees or a multinational, you must take steps to protect the valuable information you collect.

In that regard, e-commerce is no different to a physical store that has CCTV cameras to monitor theft and security guards to catch shoplifters.

But what is the cyber security equivalent, and what are the threats you need to look out for? We explain everything you need to know in this blog.

What are the threats to e-commerce businesses?

Cyber criminals use whatever means they have at their disposal to target you, but the following are some of the most common techniques.

Phishing is a type of social engineering attack in which criminals trick people into clicking a malicious link or providing sensitive information, such as login credentials.

Most phishing scams begin with an email, seemingly from a trusted sender, with an urgent request.

Criminals may target e-commerce businesses with phishing emails to plant malware on their systems, gain access to their databases or disrupt their web shop.

DDoS (distributed denial-of-service) attacks are another way criminals can disrupt businesses, using a botnet that floods the victim’s systems, servers or networks with requests until they are overwhelmed and crash.

These attacks are typically conducted by someone with a grudge against the victim or to create a distraction that enables the criminal to break into the organisation’s systems while it is busy restoring its website.

This attack uses a password-guessing program to break into systems.

E-commerce businesses should be particularly concerned in relation to their store admin panel. If this isn’t adequately protected, the entire backend of the website could be unlocked with one automated attack.

SQL (Structured Query Language) injections occur when a cyber criminal inserts malicious code into a server that uses SQL, which is a domain-specific language.

Attacks are made possible when the criminal is able to exploit a security vulnerability in an application’s software.

Once that happens, the attacker can force the server to provide access to or modify data on the system.

Protecting your organisation

Just as there is no single way that an attacker will target you, neither is there a set process that organisations must follow to stay safe.

Effective security relies on you determining your weaknesses and prioritising defences accordingly.

That said, there are plenty of proven methods to address certain weaknesses. For example, if you’re concerned about brute-force attacks, you should create a policy ensuring that employees use strong, complex passwords.

You would also benefit from implementing two-factor authentication to ensure that only approved users can log in to your systems.

Likewise, you can mitigate the threat of a phishing attack by enrolling employees on a staff awareness course to teach them about how to handle suspicious messages.

Here are some other steps you should consider:

Regular penetration tests ensure that you’re alerted to vulnerabilities promptly, giving you the chance to fix problems before criminals have the chance to exploit them.

There are many types of penetration test, but e-commerce businesses should start with a web application test.

A cyber security expert will probe your applications using the same techniques as a criminal hacker, looking for ways to exploit your systems and informing you of any weaknesses.

• Review your GDPR compliance practices

By collecting customers’ payment details, you are within scope of the GDPR (General Data Protection Regulation).

You should have taken the necessary precautions when the Regulation took effect in 2018, but you must regularly review your compliance practices, because the way you do business and the threats you face are always changing.

You also need to be aware of the changes to compliance requirements in the wake of the UK leaving the EU.

Our UK GDPR and DPA 2018 after Brexit Training Course teaches you everything you need to know, including how you should prepare for the end of the transition period.

• Ensure that you’re protecting customers’ privacy

When organisations think about cyber security, they often focus only on data protection and the threat of data breaches.

However, it’s just as important to look at data privacy. Are you using customers’ information in ways that you shouldn’t? Are you sharing their information with third parties?

If that’s the case, you’re violating the GDPR and could face a significant fine even if you haven’t suffered a data breach.

You can ensure that doesn’t happen by taking our Privacy Essentials for Marketers Training Course.

This one-day course explains the privacy considerations you must be aware of when building and maintaining websites, applications and digital marketing campaigns.

You’ll also discover the impact that relevant laws have on your business and the requirements you must comply with when using marketing tools such as analytics and referral programmes.