Welcome to this next guide in our series of blogs on ecommerce. In this article, we explore the most common ecommerce security threats and how websites can protect against them. By the end of this guide, you should have a better understanding of the growing importance of ecommerce security.
What is ecommerce security?
Ecommerce security ecompasses the measures taken to ensure that the buying and selling of goods and services online is carried out securely.
Website security is always a consideration, and nowhere is this more important than on ecommerce websites. When a user is being asked to submit sensitive information such as addresses and payment details, it’s essential that they are able to trust your site and that their information will be safe.
With the pandemic accelerating the move from brick-and-mortar stores to online retail by 5 years, the ecommerce industry has experienced an increasing number of threats. We have outlined the most common security risks below, as well as how best to protect against them.
The most common ecommerce security threats
According to a recent report published by the UK government four in ten businesses (39%) reported a data security breach or attack in the past 12 months. Businesses that rely on digital services or ecommerce are arguably the most at risk from this kind of attack.
Given that the ecommerce market is expected to reach $6.54 trillion worth of sales in 2023 (vs. $3.53 trillion in 2019), cyber-criminals are constantly looking for new ways of exploiting vulnerabilities in e-retail websites. We have listed the most common methods below.
Phishing
Phishing is a tactic used by fraudsters and hackers to trick individuals into providing their sensitive information, such as passwords and credit card details, by posing as a trusted entity. A common phishing tactic is sending emails posing as a company and providing malicious links to spoof websites where they can collect their login credentials.
Malware
Malware is the general term used to describe harmful programs deployed by hackers to access sensitive data or damage a business’ systems. In the ecommerce world, malware often takes the form of web skimming, whereby malicious code is added to a payment page to steal payment information. Common forms of malware include virus, trojans, ransomware, worms and adware.
Distributed Denial of Service Attacks (DDoS)
DDoS attacks occur when a server receives an excessive number of requests from untraceable IP addresses that causes it to crash under the pressure. By flooding a website’s server with requests, the website will crash and potentially lose out on thousands of pounds of revenue.
Brute force attacks
According to a study published by Varonis, 38% of web users have a password that never expires. These passwords are vulnerable to attack by malicious third parties, as hackers can continuously attempt to break weak passwords until they crack.
Ecommerce sites that ask users to create an account should therefore ensure that passwords meet a minimum level of security. They should also introduce multi-step authentication to reduce the risk of fraud.
How can ecommerce websites protect against security threats?
Implement SSL certificates
All websites, especially ecommerce websites, should use an SSL certificate. Not only will SSL certificates benefit your SEO (as Google considers SSL certificates in its ranking algorithm), but it will also encrypt all communication between a user’s browser and the server, thereby providing protection against hackers.
There are a number of options available to you when selecting your certification level and you’ll need to find a trusted provider of the certificate of your choice. The main options are:
Extended validation (EV) SSL certificates
An EV certificate is awarded to a website once the Certificate Authority has confirmed the applicant has the right to use the domain they have put forward and verified that ownership. According to information from Global Sign, this vetting process includes:
- “Verifying the legal, physical and operational existence of the entity”
- “Verifying that the identity of the entity matches official records”
- “Verifying that the entity has exclusive right to use the domain specified in the EV SSL Certificate”
- “Verifying that the entity has properly authorized the issuance of the EV SSL Certificate”
Once the EV certificate is granted, the website will show a padlock in the browser bar.
Organised validation (OV) SSL certificates
The Certificate Authority will check your right to use the domain with some vetting of your company, but to a lesser extent than the EV certificate.
Domain validation (DV) SSL certificates
The Certificate Authority will check your right to use the domain, but with no checks of your company.
The Extended Validation EV certificate is therefore the most secure and the version we recommend selecting for your ecommerce website. The presence of the green bar is a great trust signal for your business too, helping users to immediately see a clear signal of your trustworthiness and therefore to feel comfortable buying from your site.
Website security certificates are important. They’re great for users who will continue to value secure websites meaning conversion rates are likely to increase. Search engines are continuing to value “HTTPS everywhere” too, so secure website visibility is likely to benefit in your website’s search visibility in the short term too.
Implement multi-step authentication
Ecommerce websites should also implement multi-factor authentication (MFA), 2-factor authentication (2FA) or 2-step verification (2SV) to ensure that only legitimate transactions take place.
These terms are often used interchangeably, but they do hold several differences. MFA requires that users verify their identities by providing multiple pieces of evidence, such as a password, access to a device or a fingerprint. A website might require three pieces of evidence with MFA, whereas 2FA only requires two. 2SV is similar to 2FA, but always requires the verification to start with a username and password, which is not the case with 2FA.
By adding in this extra layer of security, ecommerce websites will block a large number of fraudsters who could do harm both to the individual and the business selling the product.
Choose a secure hosting solution
A secure hosting solution is another important consideration for ecommerce security. The best hosting providers will regularly monitor their networks, keep accurate logs and provide automatic backups periodically. These backups will help minimise any downtime should a website be compromised.
Web hosts will also install antivirus or antimalware software to scan and detect malicious scripts. Secure web hosts will then be able to alert you of these issues and provide recommendations on how to resolve them, including restoring the website to a backed-up version.
Host your site over a Content Delivery Network
Content delivery networks (CDN) are groups of servers spread out geographically that work to deliver websites more quickly to people browsing the web. Rather than having everyone landing on a website request the necessary assets from the same server, CDNs spread the load across the network and automatically send the assets from the closest server to each user.
CDNs are primarily known for improving website load times, but they also provide protection against DDoS attacks. A CDN is designed to automatically detect malicious bot traffic and filter it out from legitimate traffic. It will then route the remaining traffic into manageable amounts to prevent the server becoming overwhelmed.
Over time, a CDN will analyse traffic patterns and identify attacks from IP blocks, allowing it to better protect against further attacks in the future. DDoS mitigation can be a very useful weapon in an ecommerce website’s armoury.
Conclusion
Cybersecurity for ecommerce is an ongoing process. While implementing the solutions above will mitigate the risk of a data breach, they will not make an e-retail business impenetrable. Every ecommerce website should continuously monitor for vulnerabilities and implement solutions that protect both the customer and the business.
Ecommerce security affects every aspect of a business, including its marketing activity. Impression is a leading ecommerce agency, providing specialist services including ecommerce SEO and Google Shopping Management. If you’re looking to invest in an ecommerce strategy, get in touch and we’ll be happy to help.
