Running an eCommerce business? Here are the security essentials you must be aware of

By- Karthik Konduri,Product Manager, BigRock India

It’s no secret that India is one of the fastest growing start-up hubs in the world. At the helm of this growth are the plethora of eCommerce companies that have surfaced, each with a unique proposition and a bundle of venture capitalists pumping in a great deal of investment to boost the future of the industry. Perhaps what unites all eCommerce-focused businesses is the need to maintain an efficient website that performs with zero lag and robust security features to ensure a safe shopping experience for customers.

For an eCommerce company, security is fundamental to its operations. A security breach could range from a simple transaction bug to a potential disaster for the organization. But the most important loss will always be the equity that the brand stands to lose amongst its customers. Recent security breaches on major companies have highlighted the importance of deploying robust security features. Quite a few reports aimed at understanding the behavior of consumers on eCommerce platforms point out that a majority of customers abandon their shopping carts online as they fear credit card and payment security. Contrary to popular beliefs, website security is not an expensive affair, or accessible only to corporations with IT departments replete with security-focused engineers. It is an essential security precaution that should be provided as an easy-to-use service especially for eCommerce businesses. Broadly, security for eCommerce websites can be distinguished at three different levels. We take a look at some of the essential security measures eCommerce websites need to take to ensure effective security.

#1. APPLICATION

This is the level where you deal with all the software based security concerns ranging from regular updates to various bug-patches.

„„ Scan your applications: This can be done via non-invasive tools where the tool scans the website/ application externally to find out the major security holes that usual hackers target. This can range from a simple

open port on the server to a malicious code hidden in the code itself.

„„Secure all public-facing pages: This is usually done by encrypting all the data transferred by setting up digital certificates. This ensures confidence in end customers that the sensitive data that they have to enter cannot be eavesdropped by someone else on the network. The checkout pages should always be secured as the most sensitive data is transferred during checkout.

„„Never store any sensitive information: A lot of wellknown eCommerce websites are guilty for storing the customers’ sensitive information. One of the cardinal sins is to store customers’ password in plain-text. Sensitive information of the customer should never be stored. If that is not an option, then all the information needs to be stored in hashed format.

„„Ensure PCI compliance: Data compromise and breaches are constantly becoming more sophisticated, creating difficulties for individual merchants to stay ahead of the threats. Thus, adopting the Payment Card Industry Data Security Standard is one of the most essential steps that all merchants should undertake. Compliance

is not for a single payment but it aids in the continuously evolving process. It helps prevent security breaches and theft of payment card data, not just today, but also for future risks.

„„Invest in a risk mitigation application: There are plenty of hackers with stolen credit cards. In case a merchant accepts the payment from a stolen credit card, he has to pay the cost of the transaction back to the bank (even after the item is shipped). Investing in risk mitigation apps that integrate with the billing system is thus crucial.

#2. INFRASTRUCTURE

These are various backend safeguards that need to be established prior to the website going live. These are core pillars that will define the effectiveness of your security. „„ DDoS Protection: Distributed Denial of Service is one of the most common techniques to get your website offline. Here, the website’s network is overwhelmed with a huge flood of traffic directed at the website, thus pushing the limits of the network itself. Investing in a DDoS protection service where all the data packets are scrubbed before sending it back to the server (and dropping all the malicious traffic in the meantime) is absolutely necessary. „„Disaster Recovery (DR): Disasters are unavoidable. That said, it is necessary to recover faster and get back to the optimum performance and minimize downtimes. One such way is to account for all the possible scenarios and perform DR drills regularly. Investing in a good backup (preferably, offsite) is necessary.

„„Patching/Maintenance: Many people forget that the applications code is just an interface with the operating system on which it is running. Hence, patching the application code is not enough. It has to be followed by patching the OS and the entire stack. Also, ensure that there is monitoring in place to detect any security loophole before they are discovered by hackers.

#3. ENTERPRISE AND BUSINESS

While the above points are largely focused on the implementations

of safeguards, the continual running of business is an area which often goes undermined. IT disasters and breaches aren’t just external threats but can just as easily arise from a disregard or lack of internal protocols. Employees should be trained on the importance of securing sensitive data, the policies that affect customer data, and the precautions and subsequent measures that can be taken for disaster management.

Security and cyber threats have an interesting relationship: Created to negate each other but also to evolve with each other. While there is no such thing as 100% foolproof security, these steps will ensure that any eCommerce setup will be optimally prepared for the majority of cyber threats.