You’ve just plopped down in your favorite chair after a big Turkey Day meal. Your first “real break” in months. Your only intention today is to relax because you know the next five weeks (from CyberMonday through New Years) will be non-stop, chaotic “fun” for your new business online.

Just as your head tips back and your mind wanders off to dream about the great momentum strong holiday sales will provide for your new enterprise, the phone rings. It’s your Web site developer. The news is not good. Somehow, someone has compromised your site’s customer database and taken critical customer data, like credit card information.

What you do in the next 48 hours will be critical to getting your business back online, on track, and on safe ground. Two things to remember: Transparency and Communication. It’s not just about restoring your Web site to a secure state but restoring your customer’s confidence to continue to shop with you.

Step 1: Announce and Assess (Timeframe: Immediately – 12 hours after the breach is discovered)

Immediately, get your site offline. Google has some specific recommendations regarding the best way to accomplish this.

Customers appreciate being notified as soon as possible, and they would rather hear it from you first. Plus, being the first to report the cyber crime lets you control the message. Concurrently, make a general public statement about what has happened and instruct all individuals (or companies) who have done business with your company to monitor their credit report and banking statements for inconsistencies.

Deliver the statement to all concerned parties via email and make sure to train all customer-facing representatives with the appropriate dialogue. Here’s a concise and effective example from Balmar Incorporated.

Step 2: Conduct a Deeper Investigation (Timeframe: 12 hours – 36 hours+)

Computer forensic auditors, PCI representatives, governmental agencies, and others may be involved in the process depending on the nature of your business.

Start by interviewing all personnel responsible for securing your environment and find out if they are aware of any known vulnerabilities. Next, begin reviewing log files with the following specific goals in mind: Identifying the date(s) of the breach, how many customers were compromised, and what information was stolen.

Read the rest of this entry »

As consumers proceed full force into the online shopping season, it’s important to remember that good-hearted, upstanding citizens won’t be the only ones filling their shopping cart. As cybercriminals prepare to trade massive scores of PII (personally identifiable information) for cash in the “Underground Economy”, it’s important you recognize the risks and take steps necessary to protect your identity.

Symantec’s report on cybercrime reveals the volume and lucrativeness of identity theft.

• Credit cards, the hottest commodity, account for nearly 33% of all illegal transactions and produce approximately $5.3 billion in revenue each year. Credit card numbers fetch between $0.10 to $25 per card, so compromising as many accounts as possible motivates thieves in this category.
• Stolen financial accounts, the next most lucrative target, produce approximately $1.7 billion in revenue (20% of the total volume). Historically, stolen bank accounts have carried an average balance of $40,000 and sold for $10 and $1,000 each.

Crafty, sneaky, and increasingly sophisticated hacker techniques make it difficult to detect schemes, but (re)educating yourself on the risks and acting on protective measures will help prevent identity theft from ruining your holiday season.

#1 Check Statements Daily and Monitor Credit – Review transactions flowing thru your bank and credit card accounts daily. Detecting and reporting fraud or identify theft fast will “stop the bleeding” and increase the chances for a complete financial recovery. Federal law provides consumers one free copy of their credit report (from each of the reporting bureaus) every year. Toward the end of the middle or end of the holiday shopping season may be a strategic time to exercise your right. Contact Experian, TransUnion, and Equifax annually.

#2 Implement Password Confidentiality and Strength – Stolen passwords contribute a great deal to identity theft and security breaches taking place online. Password security seems so simple and obvious, but the recent incident with Hotmail shows that consumers are not following basic guidelines for safety and much work and education remains to be done. So, here are the top password guidelines (AGAIN!)

• Don’t share your password with anyone.
• Change passwords often.
• Set a different, strong password for every website you visit. For example, Twitter should not have the same PW as your bank account or email, etc.
• Strong passwords include 8 characters and a mix of symbols, numbers and letters.
• Finally, a service like One Password can help make the task of implementing good password safety more manageable.

Read the rest of this entry »

Tis the season for shopping, travel, food, and family. Unlike holiday seasons of past, planning and performing these activities will involve the web. Booking travel online. Searching for great buys, and purchasing gifts for your family, friends, and clients. Discovering the best recipes and party ideas to ensure your holiday gathering is memorable. When you sit back to think about it, eCommerce is infiltrating our shopping lives, and for good reason.

• eCommerce websites never close.
• You can easily compare prices from multiple sellers.
• No lines, crowded parking lots, or germs (H1N1).

All these benefits mean more and more people (of all ages and economic conditions) will be shopping online during the holidays in 2009 – enough to generate an estimated $156 Billion in sales. (Online shopping represents 36% of sales expected from all channels this winter according to the National Retail Federation.)

That’s music to the ears of cyberthieves. Like retailers, hackers are going into their busy season. The influx of shoppers using eCommerce websites over the next several weeks means that there are more cyber crime victims upon whom to prey.

Even if cybercriminals can only maintain conversion rates for malware (Trojans, rootkits, spyware, zero-day exploits, keyloggers, and viruses) and phishing attempts (spam), the voluminous spike in traffic means they will increase their earnings. Cyber thieves know that unpredictable traffic patterns and spikes can make it difficult to detect a security breach meaning hacks carried out during the holidays may go overlooked for a longer period of time.

So that’s that backdrop in front of which a secure web hosting provider views holiday 2009, and we’re up for the challenge.

Read the rest of this entry »