Business Health & Compliance Update - Securing Your Website
Update Details: A new Business Health and Compliance update has been issued on Securing Your Website. The full article has been emailed to subscribers with the Business Health and Compliance preference and is available as a PDF on the Business Health and Compliance Updates page.
Why Securing Your Website Matters
Two critical flaws found in PHP, the software that most websites run on, let attackers take over web servers without a password. A great many websites were taken offline, because for many of them the only sure way to protect the data they held was to remove it from the server completely. Most website break-ins don't need a clever attacker. They use a flaw that is already public, against a site nobody has updated.
What the Securing Your Website Update Covers
The update starts with a risk assessment: which websites and web systems a business has, what software each one runs, what data it holds, who keeps it updated, and what would be lost if one was taken over. It then sets out where the exposure sits in a self-hosted website, from the server software and content management system to the plugins and themes added over the years, and the customer data often held on the same server.
A practical set of controls follows, from getting written confirmation that a site has been patched to switching off old sites, building simple sites as plain pages, handing the patching to a hosted provider and keeping a static copy of the site ready. A closing section covers where ISO 27001 fits, and why significant risks belong on a risks register alongside everything else.
Getting the Full Securing Your Website Update
The full update, along with the supporting documents and example risk assessments for managing website and cyber attack risks, is provided to subscribers as part of the update service.
Business Health and Compliance updates are issued as part of the ISO and legal update service, so each issue is emailed to subscribers as it is published. alphaZ subscribers can download every issue in pdf format from the Business Health and Compliance Updates page, for topic-specific training or for sending out to workers.