We are currently seeing a clear increase in attacks on websites and webshops. Whereas attackers previously primarily looked for vulnerabilities in software, they are now increasingly targeting login credentials directly.
Passwords are collected from data breaches, guessed using automated tools, or obtained via phishing, and subsequently tried out on a large scale on websites and online stores. Because many people reuse passwords, a single leaked password is often enough to gain access elsewhere.
Even smaller websites and webshops are targeted daily, simply because login credentials hold value for malicious actors everywhere. If someone gains access to your management environment with a stolen password, this can lead to the loss of customer data, disruption of your website or webshop, or misuse of your system for other purposes.
We follow these developments closely and continuously look at how we can better protect our clients' websites and webshops. For us, security is not a one-off action, but something we pay ongoing attention to, from monitoring vulnerabilities to applying updates and tightening settings.
We ensure that this security layer aligns well with the way you and your employees work, so that logging in remains pleasant while security increases significantly.
One of the measures we are currently highlighting is two-factor authentication, also known as 2FA. This adds a second layer of verification to the login process, in addition to the username and password.
Even if a password falls into the wrong hands, someone cannot simply log in with it. An additional, personal verification step is always required before access is granted.
In many attacks, no human is involved. Automated tools try thousands of username and password combinations on login pages day and night, often based on previously leaked data from other websites. This is called credential stuffing, and it happens on a scale that would be impossible by hand. As soon as one of those combinations happens to match, the attacker has immediate access, without anything unusual being visible on the front end of your website.
In addition, we are seeing more frequent targeted phishing attempts, where employees or administrators receive an email resembling a known sender with the intention of stealing login credentials. Here too, a single moment of inattention can be enough to lose access to your own environment.
The annoying thing about both methods is that they often go unnoticed until damage has already been done. Think of changes to your website, unauthorized orders in your webshop, or the surreptitious addition of malicious code.
Our security consists of multiple layers that together provide a solid foundation.
These efforts largely take place in the background but are constantly evolving. New threats call for new measures, and therefore we continually adapt our approach to what is happening in the digital world at that moment.
We keep server software and plugins up to date so that known vulnerabilities are quickly patched.
We monitor websites and webshops for suspicious activity so that we can detect unusual login attempts or changes in a timely manner.
And we regularly take a critical look at our customers' settings to see where security can be tightened even further.
Especially for website and webshop management environments, where access to sensitive data and settings is at stake, this is a valuable addition to standard security.
Two-step verification adds a second verification step to the login process, in addition to the username and password.
After entering the password, the system asks for an additional code, for example via email or an app.
This code is different every time and valid for only a short time, rendering it useless to an attacker, even if they have already managed to obtain the password.
For you and your employees, little changes in daily practice. Logging in takes a few extra seconds, but the protection this provides is significant.
In addition to what we do in the background, you can also do a number of things yourself to reduce the risk of unauthorized access:
We fully install and configure 2FA for your website or webshop for a one-time fee of 249 euros. Are you interested, or would you like to know more about what this means for your situation? Feel free to contact us; we are happy to discuss it with you.
