It's important to protect your business and customers from the many dangers posed by hackers and fraudsters online. Card-not-present (CNP) fraud isn't the only security risk merchants face online – data breaches are pervasive and even small e-commerce shops are at risk.
\nIn 2018, SMBs made up 43% of all data breach victims, per the Verizon Data Breach Investigations Report (DBIR).
\r\nHere are five important but sometimes overlooked steps that you can take now to safeguard your online store and keep your customers' trust.
\r\nAlmost everyone with a website knows they need a secure sockets layer (SSL) certificate to show that their site is trustworthy. What many e-commerce shop owners don't know, especially when they first launch their stores, is that SSL certificates are not all the same.
\r\nThe free SSL option that comes with many web hosting plans may work well enough for a small site that doesn't have a lot of visitors entering payment information. But for the strongest possible encryption to protect your customers from data theft, and to fully validate your website's trustworthiness, you need an extended validation (EV) SSL. With an EV SSL, your visitors see the green padlock and a green bar with your company name, proving that you have the strongest SSL protection for their data.
\r\nGetting an EV SSL requires more steps than getting a free, basic SSL. You'll need to give your certification provider proof of:
\r\nEV SSL fees start at a few hundred dollars a year. This is a worthwhile investment that protects your business and assures your customers that they can shop safely with you.
\r\nTimely software updates and patches are a must for every business, especially online stores. One of the top three ways hackers stole customer data from retailers last year, according to the DBIR, was by exploiting vulnerabilities in merchants' web apps. Hackers are happy to exploit other software vulnerabilities, too.
\r\nIt's tempting to assume that security patch alerts are rare, but they're not. As of this writing, a quick glance at the tech headlines shows security patches deployed this week by Apple, Microsoft, Dell, Atlassian and other major tech providers. Hackers are always probing for weak spots where they can break in, which means that fraud prevention – including code patching – is a constant race to see who can stay a step ahead.
\r\nKeep hackers from stealing your customers' payment card numbers and login credentials by keeping all your software up to date. Act on critical update alerts from your providers right away, follow the news on security patches and consider using a patch management service that continuously scans for and schedules patches and updates.
\r\nWith a program for patches and updates in place, your store will be protected against many types of malware. However, cybercriminals are always finding new ways to attack. When they spot a vulnerability that no one else has discovered, they can use it to put malware on your site.
\r\nWhen that happens, you're looking at a zero-day exploit – one for which there's not yet a patch, because the good guys don't know it needs patching. Worse, that zero-day exploit may go undetected for days, months or even longer. During that time, your store can leak data until the vulnerability is found and patched.
\r\nThere are other malware risks, too. Consider formjacking, a relatively new type of data theft. Formjacking steals data from website forms in a way that's often compared to card skimming at fuel pumps. Formjackers exploit weaknesses in web apps – often third-party tools that stores add to their sites – to insert code that steals customer data as it comes in. Without regular scans of all the code on your site, formjacking can be impossible to detect.
\r\nThe consequences of formjacking can be severe. In 2018, British Airways was formjacked by cybercriminals who stole payment data from more than 400,000 BA customers as they bought tickets. In addition to damaged customer trust and bad publicity, British Airways now faces a $229 million dollar penalty – dubbed the \"biggest data protection fine in history\" – from the UK's Information Commissioner's Office.
\r\nTo reduce your risk of formjacking and to detect zero-day exploits as soon as possible, your site needs anti-malware protection that continuously scans the code for elements that don't belong.
\r\nWe all know we should use unique, secure passwords on all our accounts – especially on our business accounts. We also know that no one should get 500 attempts to log in to your website. Unfortunately, bad password habits are still common, and they can make data breaches easy. If criminals can guess your login credentials, crack them with brute-force bot attacks, or buy them online, you can end up with strangers in your system, rummaging through your company's emails, databases and web apps.
\r\nStep up your password game by finding out if you're already compromised. Have I Been Pwned? is a website run by Microsoft regional director Troy Hunt. It has found more than 7.8 billion breached passwords for sale on the dark web. You can use the site to see if your passwords have already been compromised, so you can change them right away. You can also sign up for notifications, so you'll know if your team's passwords are ever stolen.
\r\nNext, strengthen your company's passwords and login process. Require everyone with internal access to use a strong password that's not used for any other account. Limit the number of login attempts that employees and vendors can make before they're locked out of the system and have to contact tech support. Though this may be a hassle for forgetful team members, it can prevent brute-force password cracking.
\r\nPhishing today is so much more sophisticated than the badly written cons of a few years ago. Now, criminals may attempt to impersonate you or members of your team in emails. For example, they may pose as you and email
\r\nWhether they're after money, privileged information, database access, reward program information or customer payment data, phishers are a serious problem. They know how to make urgent requests seem compelling. They know that people won't send login credentials via email, so they've ramped up their use of phishing sites that look legitimate but capture login data. And, their messages can get past secure email gateways that were originally designed to look for links and attachments that contained malware.
\r\nIf your business is relying on email security tools that don't look for advanced email threats, it's time to shop for better protection, step up your anti-phishing training, and instruct your team not to transfer money or sensitive data without verifying those email requests by phone or face-to-face. [Are you looking for the right internet security and antivirus software? Check out our reviews and best picks.]
\r\nEach of these five steps adds a layer of security to your online store and your e-commerce business. But, there's one more layer to add: keeping up with e-commerce security best practices. When you stay up to date on cybersecurity, you protect your customers, your revenue and your brand, and you won't have to worry about overlooking steps that can safeguard your business.
\n","docType":"article","guid":"articles_e09ecf907cff59299972f9febaa2a40e","lastModified":"2019-07-25T17:00:00.000Z","published":"2019-07-25T17:00:00.000Z","structuredData":null,"subtitle":"Keep your online store safe from hackers by following these basic security guidelines.","template":"v1","title":"Is Your E-Commerce Business Overlooking These Security Basics?","type":"article","author":{"avatar":null,"bio":"Rafael Lourenco is Executive Vice President at ClearSale, a Card-Not-Present fraud prevention operation that protects e-commerce merchants against chargebacks. The company’s flagship product, Total Guaranteed Protection, is an end-to-end outsourced fraud detection solution for online retailers. Follow on twitter at @ClearSaleUS or visit http://clear.sale/.","name":"Rafael Lourenco","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/rafael-lourenco-5a71b823/","twitter":"https://twitter.com/clearsaleus","website":"https://www.clear.sale/"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/9dac2af9242e2349bf049cf1bf75c63ae00f1.jpg","profile":{"company":"ClearSale","jobTitle":"EVP","website":"https://www.clear.sale/"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Security","slug":"security"}},"meta":{"robots":"index, follow","description":"Here are five important, but sometimes overlooked, steps that e-commerce merchants can take to safeguard their online stores from hackers and fraudsters.","title":"5 E-Commerce Security Tips to Protect Your Online Store - business.com"},"parsedContent":{"toc":[{"id":"invest-in-a-top-of-the-line-ssl-certificate","title":"Invest in a top-of-the-line SSL certificate."},{"id":"get-serious-about-patches-and-updates","title":"Get serious about patches and updates."},{"id":"make-malware-scans-a-priority","title":"Make malware scans a priority."},{"id":"put-password-security-on-your-agenda","title":"Put password security on your agenda."},{"id":"cast-a-net-to-stop-spear-phishing","title":"Cast a net to stop spear-phishing."}],"json":[{"component":"p","children":["It's important to protect your business and customers from the many dangers posed by hackers and fraudsters online. Card-not-present (CNP) fraud isn't the only security risk merchants face online – data breaches are pervasive and even small e-commerce shops are at risk."]},{"component":"p","children":["In 2018, SMBs made up 43% of all data breach victims, per the ",{"component":"a","props":{"href":"https://enterprise.verizon.com/resources/executivebriefs/2019-dbir-executive-brief.pdf","target":"_blank","rel":"noopener external nofollow"},"children":["Verizon Data Breach Investigations Report (DBIR)"]},"."]},{"component":"p","children":["Here are five important but sometimes overlooked steps that you can take now to safeguard your online store and keep your customers' trust. "]},{"component":"h2","props":{"id":"invest-in-a-top-of-the-line-ssl-certificate"},"children":["Invest in a top-of-the-line SSL certificate."]},{"component":"p","children":["Almost everyone with a website knows they need a secure sockets layer (SSL) certificate to show that their site is trustworthy. What many e-commerce shop owners don't know, especially when they first launch their stores, is that SSL certificates are not all the same. "]},{"component":"p","children":["The free SSL option that comes with many web hosting plans may work well enough for a small site that doesn't have a lot of visitors entering payment information. But for the strongest possible encryption to protect your customers from data theft, and to fully validate your website's trustworthiness, you need an ",{"component":"a","props":{"href":"https://cabforum.org/about-ev-ssl/","target":"_blank","rel":"nofollow"},"children":["extended validation (EV) SSL"]},". With an EV SSL, your visitors see the green padlock and a green bar with your company name, proving that you have the strongest SSL protection for their data."]},{"component":"p","children":["Getting an EV SSL requires more steps than getting a free, basic SSL. You'll need to give your certification provider proof of:"]},{"component":"ul","children":[{"component":"li","children":["Your business license or registration"]},{"component":"li","children":["Your DBA "]},{"component":"li","children":["Your physical address"]},{"component":"li","children":["Your personal information "]},{"component":"li","children":["Your signature on the EV SSL agreement"]}]},{"component":"p","children":["EV SSL fees start at a few hundred dollars a year. This is a worthwhile investment that protects your business and assures your customers that they can shop safely with you."]},{"component":"h2","props":{"id":"get-serious-about-patches-and-updates"},"children":["Get serious about patches and updates."]},{"component":"p","children":["Timely software updates and patches are a must for every business, especially online stores. One of the top three ways hackers stole customer data from retailers last year, according to the DBIR, was by exploiting vulnerabilities in merchants' web apps. Hackers are happy to exploit other software vulnerabilities, too."]},{"component":"p","children":["It's tempting to assume that security patch alerts are rare, but they're not. As of this writing, a quick glance at the tech headlines shows security patches deployed this week by Apple, Microsoft, Dell, Atlassian and other major tech providers. Hackers are always probing for weak spots where they can break in, which means that fraud prevention – including code patching – is a constant race to see who can stay a step ahead. "]},{"component":"p","children":["Keep hackers from stealing your customers' payment card numbers and login credentials by keeping all your software up to date. Act on critical update alerts from your providers right away, follow the news on security patches and consider using a patch management service that continuously scans for and schedules patches and updates."]},{"component":"h2","props":{"id":"make-malware-scans-a-priority"},"children":["Make malware scans a priority."]},{"component":"p","children":["With a program for patches and updates in place, your store will be protected against many types of malware. However, cybercriminals are always finding new ways to attack. When they spot a vulnerability that no one else has discovered, they can use it to put malware on your site. "]},{"component":"p","children":["When that happens, you're looking at a ",{"component":"a","props":{"href":"https://searchsecurity.techtarget.com/definition/zero-day-vulnerability","target":"_blank","rel":"nofollow"},"children":["zero-day exploit"]}," – one for which there's not yet a patch, because the good guys don't know it needs patching. Worse, that zero-day exploit may go undetected for days, months or even longer. During that time, your store can leak data until the vulnerability is found and patched."]},{"component":"p","children":["There are other malware risks, too. Consider ",{"component":"a","props":{"href":"https://www.pcmag.com/article/366770/you-need-to-protect-your-website-against-formjacking-right-n","target":"_blank","rel":"noopener external nofollow"},"children":["formjacking"]},", a relatively new type of data theft. Formjacking steals data from website forms in a way that's often compared to card skimming at fuel pumps. Formjackers exploit weaknesses in web apps – often third-party tools that stores add to their sites – to insert code that steals customer data as it comes in. Without regular scans of all the code on your site, formjacking can be impossible to detect. "]},{"component":"p","children":["The consequences of formjacking can be severe. In 2018, British Airways was formjacked by cybercriminals who stole payment data from more than 400,000 BA customers as they bought tickets. In addition to damaged customer trust and bad publicity, British Airways now faces a $229 million dollar penalty – dubbed the \"",{"component":"a","props":{"href":"https://tech.newstatesman.com/gdpr/card-skimming-attacks-ba","target":"_blank","rel":"nofollow"},"children":["biggest data protection fine in history"]},"\" – from the UK's Information Commissioner's Office. "]},{"component":"p","children":["To reduce your risk of formjacking and to detect zero-day exploits as soon as possible, your site needs anti-malware protection that continuously scans the code for elements that don't belong. "]},{"component":"h2","props":{"id":"put-password-security-on-your-agenda"},"children":["Put password security on your agenda."]},{"component":"p","children":["We all know we should use unique, secure passwords on all our accounts – especially on our business accounts. We also know that no one should get 500 attempts to log in to your website. Unfortunately, bad password habits are still common, and they can make data breaches easy. If criminals can guess your login credentials, crack them with brute-force bot attacks, or buy them online, you can end up with strangers in your system, rummaging through your company's emails, databases and web apps."]},{"component":"p","children":["Step up your password game by finding out if you're already compromised. ",{"component":"a","props":{"href":"https://haveibeenpwned.com/","target":"_blank","rel":"noopener external nofollow"},"children":["Have I Been Pwned?"]}," is a website run by Microsoft regional director Troy Hunt. It has found more than 7.8 billion breached passwords for sale on the dark web. You can use the site to see if your passwords have already been compromised, so you can change them right away. You can also sign up for notifications, so you'll know if your team's passwords are ever stolen."]},{"component":"p","children":["Next, strengthen your company's passwords and login process. Require everyone with internal access to use a strong password that's not used for any other account. Limit the number of login attempts that employees and vendors can make before they're locked out of the system and have to contact tech support. Though this may be a hassle for forgetful team members, it can prevent brute-force password cracking."]},{"component":"h2","props":{"id":"cast-a-net-to-stop-spear-phishing"},"children":["Cast a net to stop spear-phishing."]},{"component":"p","children":["Phishing today is so much more sophisticated than the badly written cons of a few years ago. Now, criminals may attempt to impersonate you or members of your team in emails. For example, they may pose as you and email"]},{"component":"ul","children":[{"component":"li","children":["your employees, requesting urgent wire transfers."]},{"component":"li","children":["payroll team, asking them to route your direct deposit to a new bank account."]},{"component":"li","children":["customers or employees, telling them to log in to a site (that then steals their account credentials)."]},{"component":"li","children":["vendors and partners, requesting sensitive information."]}]},{"component":"p","children":["Whether they're after money, privileged information, database access, reward program information or customer payment data, phishers are a serious problem. They know how to make urgent requests seem compelling. They know that people won't send login credentials via email, so they've ramped up their use of ",{"component":"a","props":{"href":"https://blog.knowbe4.com/phishing-sites-increase-by-30-in-the-first-quarter-of-2019-putting-saas-and-webmail-at-risk","target":"_blank","rel":"nofollow"},"children":["phishing sites"]}," that look legitimate but capture login data. And, their messages can get past secure email gateways that were originally designed to look for links and attachments that contained malware. "]},{"component":"p","children":["If your business is relying on email security tools that don't look for advanced email threats, it's time to shop for better protection, step up your anti-phishing training, and instruct your team not to transfer money or sensitive data without verifying those email requests by phone or face-to-face. ",{"component":"strong","children":["[Are you looking for the right ",{"component":"Link","props":{"href":"https://www.business.com/categories/best-antivirus-and-internet-security/"},"children":["internet security and antivirus software"]},"? Check out our reviews and best picks.]"]}]},{"component":"p","children":["Each of these five steps adds a layer of security to your online store and your e-commerce business. But, there's one more layer to add: keeping up with e-commerce security best practices. When you stay up to date on cybersecurity, you protect your customers, your revenue and your brand, and you won't have to worry about overlooking steps that can safeguard your business."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5d3/7b3c87b4374ba208b458a/1500-0-","caption":"fizkes/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"Your E-Commerce Data Security Checklist for 2020","canonical":"https://www.business.com/articles/ecommerce-data-security-checklist/","slug":"ecommerce-data-security-checklist","thumbnail":"https://www.business.com/images/content/5e8/22b9f7b4374651e8b456e/1500-0-","dek":"To protect your business from hackers and data theft – and to keep the customer trust you've worked hard to earn – make sure your company follows these 10 data security best practices.","lastModified":"2020-03-30T17:20:00Z","published":"2020-03-30T17:20:00Z","sponsored":false},{"title":"Why and How to Build Cybersecurity Into Your Company Culture","canonical":"https://www.business.com/articles/cybersecurity-company-culture/","slug":"cybersecurity-company-culture","thumbnail":"https://www.business.com/images/content/5e5/ede389c658a45028b456a/1500-0-","dek":"Data breaches are a growing problem for retailers. Learn how you can build cybersecurity awareness into your business's culture.","lastModified":"2020-03-03T23:00:00Z","published":"2020-03-03T23:00:00Z","sponsored":false},{"title":"What Is Website Security? Security Tips to Protect Your Website From Hackers","canonical":"https://www.business.com/articles/tips-to-protect-your-website-from-hackers/","slug":"tips-to-protect-your-website-from-hackers","thumbnail":"https://www.business.com/images/content/5ee/ba2b27b4374ed648b4572/1500-0-","dek":"Even as new and more effective security features and functions for websites emerge regularly, hackers are also always reinventing themselves to navigate around these security features.","lastModified":"2020-06-19T17:30:00Z","published":"2020-06-19T17:30:00Z","sponsored":false},{"title":"Restaurant Security: A Guide to Getting Your Money's Worth","canonical":"https://www.business.com/articles/restaurant-security-guide/","slug":"restaurant-security-guide","thumbnail":"https://www.business.com/images/content/58a/dced22f87b17e076bf981/1500-0-","dek":"It's hard to determine the ROI you will get from increasing your restaurant security.","lastModified":"2017-02-21T08:00:00Z","published":"2017-02-21T08:00:00Z","sponsored":false},{"title":"M-Commerce Is Booming. So Is M-Commerce Fraud","canonical":"https://www.business.com/articles/m-commerce-fraud/","slug":"m-commerce-fraud","thumbnail":"https://www.business.com/images/content/5ef/1e6987b437406198b456a/1500-0-","dek":"As mobile commerce continues to boom, so, too, does m-commerce fraud. For businesses, the solution is to create a multilayered defense.","lastModified":"2020-06-23T19:03:00Z","published":"2020-06-23T19:03:00Z","sponsored":false},{"title":"How to Keep Your Online Store's Rewards Program Secure","canonical":"https://www.business.com/articles/rewards-program-security/","slug":"rewards-program-security","thumbnail":"https://www.business.com/images/content/5d5/1d5857b4374707b8b4582/1500-0-","dek":"Loyalty programs are such a tempting target for fraudsters and steps merchants can take to protect their rewards program.","lastModified":"2019-08-15T13:00:00Z","published":"2019-08-15T13:00:00Z","sponsored":false},{"title":"10 Common Social Engineering Tactics Used by Attackers","canonical":"https://www.business.com/articles/10-common-social-engineering-tactics-used-by-attackers/","slug":"10-common-social-engineering-tactics-used-by-attackers","thumbnail":"https://www.business.com/images/channel/technology.jpg","dek":"Learn What Social Engineering Is and How to Protect Your Business From Predators","lastModified":"2016-07-25T18:00:00Z","published":"2016-07-25T18:00:00Z","sponsored":false},{"title":"Prepare for the Worst: How to Create a Cyber Security Incident Response Plan","canonical":"https://www.business.com/articles/prepare-cyber-security-incident-response-plan/","slug":"prepare-cyber-security-incident-response-plan","thumbnail":"https://www.business.com/images/channel/technology.jpg","dek":"Effective CSIR Plan is an essential aspect of organizations in data governance strategy to make aware about current security readiness.","lastModified":"2016-01-13T19:00:00Z","published":"2016-01-13T19:00:00Z","sponsored":false},{"title":"How to Assess the Cybersecurity Risk of Your Small Business","canonical":"https://www.business.com/articles/assess-small-business-cybersecurity/","slug":"assess-small-business-cybersecurity","thumbnail":"https://www.business.com/images/content/5ed/118db7b437422298b4576/1500-0-","dek":"Security risk profiles can help quantify cybersecurity risk.","lastModified":"2020-06-03T13:41:00Z","published":"2018-06-15T13:30:00Z","sponsored":false},{"title":"5 Reasons Traditional Authentication Methods Need to Be Replaced","canonical":"https://www.business.com/articles/replace-traditional-authentication-methods/","slug":"replace-traditional-authentication-methods","thumbnail":"https://www.business.com/images/content/5e1/e60889c658a79508b4578/1500-0-","dek":"Traditional online authentication methods are broken. Convenience is trumping cybersecurity and it's a risk to your business and customers. Here's why you need to consider a more secure login method.","lastModified":"2020-01-15T17:00:00Z","published":"2020-01-15T17:00:00Z","sponsored":false},{"title":"17 Techniques for Protecting Online Client Payments","canonical":"https://www.business.com/articles/safety-techniques-online-payments/","slug":"safety-techniques-online-payments","thumbnail":"https://www.business.com/images/content/5e2/a088c7b4374dd408b4568/1500-0-","dek":"Here are some ways to keep crucial data secure.","lastModified":"2020-01-28T13:00:00Z","published":"2020-01-28T13:00:00Z","sponsored":false},{"title":"Wireless Security In The Enterprise: Deploying WPA2-Enterprise","canonical":"https://www.business.com/articles/deploying-wpa2-enterprise-encryption/","slug":"deploying-wpa2-enterprise-encryption","thumbnail":"https://www.business.com/images/content/5d0/1910b5a215e5d7d8b4580/1500-0-","dek":"The IEEE 802.11ax draft standard promises improved range, throughput and resiliency.","lastModified":"2018-07-11T14:26:00Z","published":"2018-07-11T14:26:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df905909c658a7e538b4567/Faxing_junce_Getty.jpg","canonical":"https://staging.business.com/categories/online-fax-services/","title":"The Best Online Fax Services of 2021","dek":"Online fax services are growing as more companies divest from conventional fax machines in favor of an automated, scalable and cost-effective option. Here's a look at some of the best online fax services on the market. ","slug":"online-fax-services","lastModified":"2021-03-02T16:07:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-07-25T17:00:00.000Z","template":"v1","title":"Is Your E-Commerce Business Overlooking These Security Basics?","meta":{"robots":"index, follow"},"docType":"articles","slug":"e-commerce-security-basics","canonical":"https://staging.business.com/articles/e-commerce-security-basics/","skipTOC":false}},"staticQueryHashes":[]}