With all of the talk in the industry about the threat of hacking, and Equifax currently experiencing one of the largest hacks to date, it’s worth taking a step back to realize how insecure your eCommerce business may really be.
Moving forward, the market is going to become more sophisticated and start putting more trust into businesses that they know will keep their information safe.
As an eCommerce store owner, you have access to a large amount of sensitive information, that’s typically stored on a computer, putting your business at risk for being hacked. Even if you’re a smaller operation, you can’t ignore the threats that are posed to your business on a daily basis.
Sticking your head in the sand and assuming that you aren’t facing threats because you’re a smaller business is the wrong approach to take, and one that could land you in major trouble should a hacker ever figure out that you’re ignoring proven security measures.
If you want to make sure your business and customers are not only safe from the threat of hackers, but force hackers to give up before they try to break your security, here are 15 different ways you can ensure your eCommerce business is secure.
#1 - Use a secure eCommerce platform.
This is the biggest factor that’s going to affect your store’s security.
If you are, for instance, using WooCommerce, you need to make sure that it is always updated to the latest release, that you keep WordPress updated to the latest release, and that you ensure all plugins you’re using stay updated.
Most mainstream eCommerce platforms, like Shopify, are going to have security measures in place to keep your customer’s data safe.
However, if you are using a new eCommerce platform, or one that doesn’t place a huge emphasis on security, you will want to begin migrating over to a more developed platform -- one that understands security and how to maintain a high level of security.
Outdated software is one of the biggest causes of security breaches, and hackers can utilize “footprints” that the software leaves behind to find stores that may be outdated. They can then target those stores one at a time.
#2 - Ensure your checkout is secure.
Your checkout area is one of the biggest targets on your store.
Some hackers will attempt to hijack the database where your customer’s information is being stored, while others are going to attempt to intercept that data as it’s being entered into your checkout form and then transmitted to a processing server.
This plays, largely in part, to the platform that you’re hosting your eCommerce store on.
However, you can also implement security features such as encrypted SSL and secure checkouts to make sure hackers cannot intercept the information being transferred.
An SSL certificate will encrypt the information that your customer has entered before it gets transmitted so that even if a hacker is able to intercept it, they will be unable to do anything with the information they’ve collected.
#3 - Don't store sensitive data.
If Equifax is any evidence, hackers rely on companies and businesses storing sensitive information and then letting security protocols lapse so they can take advantage of the holes to access that information for themselves.
Equifax is in the business of collecting and storing people’s sensitive information, which made them a prime target for hackers. It’s easy to say that this isn’t the first time hackers have attempted to gain access to their servers and databases. Probably not the 100th time.
For the most part, to run your business efficiently, you really do not need to store any information outside of your customer’s name, email address, home address, phone number, login, and password.
If you do collect and store that information, you need to ensure it’s being stored on a secure, encrypted database. You also need to make sure your customers know not to use the same password for your store that they use for other sensitive accounts, like their email or bank accounts.
#4 - Use a CVV verification system.
A CVV, or credit card verification value, helps you limit the number of fraudulent transactions by requiring the customer to have their credit card in their physical possession, in order to read the CVV number from the back of the card.
While this strategy won’t help you completely eliminate credit card fraud in your store, you can dramatically reduce the possibilities.
Many hackers aren’t going to have the physical card in front of them, so they will be unable to enter the proper CVV to move forward with the transaction. If they don’t have the CVV number, they’re not going to be able to commit credit card fraud.
Again, this won’t stop all fraud, but it can reduce the chances you have chargebacks and fraudulent charges in your store. If the hacker is able to get the CVV from the credit card they’re using to make fraudulent purchases, they can still move forward.
#5 - Require strong passwords.
Sometimes, hackers don’t even need to break your security because of software glitches, keyloggers, or any other software-focused means.
Sometimes, all it takes is them accessing a weak password and using it to take over any databases where you have sensitive information stored.
That’s why you need to require both your customers, and your staff to use secure passwords. This is especially true if your staff members have access to the areas where you are storing sensitive information, if you’re storing it.
On top of making sure your customers know not to use the same password for their store login that they use for their email accounts or banking accounts, you also want to make sure you are requiring them to use secure password.
A truly secure password combines a mixture of uppercase and lowercase letters, numbers, and symbols. These are nearly impossible to “brute force” attack, and cannot be guessed.
#6 - Monitor suspicious activity.
If your store is being targeted by hackers, you can use the information they’re giving you to help make sure your store is secure.
The best way to make sure you’re staying ahead of the hackers is to figure out what they’re doing now, and actively work to make sure those parts of your store have been secured.
However, keeping up with the hackers could require you to obtain a position in the “dark underbelly of the internet”, where most of the conversations about the latest hacks and exploits are taking place.
Or, you can start monitoring the suspicious activity on your store.
If a hacker has devoted energy to attack one part of your store, you can safely assume that there is a hack or exploit out that focus on that part of eCommerce stores. For instance, if they’re attacking your login screen, you know that it’s time to ensure your login screen is secure.
To get this level of awareness, though, you have to actively monitor what’s happening to your store, and then understand what you need to do to increase your security in those areas.
#7 - Use layered security.
Layered security refers to having different layers that hackers will need to get through before they’re actually able to access sensitive information, if you’re storing it.
To layer your security, you’re first going to want to make sure that you have a firewall in place, and that you’re using an SSL certificate to encrypt the transactions being made through your server.
Then, you’ll want to add other layers into the store based on the applications you’re using. For instance, securing your contact form, login forms, and search queries, and keeping that information separate from your customer information can make SQL attacks pointless.
SQL attacks will inject information into your database that lets hackers gain access to it, and if you’re storing customer information in the same database as the information collected from forms on the front-end of your store, you could be creating a security risk.
#8 - If you have employees, train them.
Employees can be one of the weakest points in your security. It’s human nature to relax, and not think about parts of the business that aren’t actually in their job description.
Security, in this instance, is one of the first aspects to get ignored, with your employees assuming someone else has it taken care of.
To give you an example, your employees could be collecting sensitive information from your customers during chat sessions or in an email log, and not doing anything with the information once the chat session has ended.
You need to ensure that your employees are well trained (and their training remains up to date) to ensure they are not causing holes in your security policies, and potentially putting your customer’s information at risk.
There should be written policies and documentation in place, and your employees should be aware of the laws and how they govern the handling of sensitive information.