How Secure is a Secure Website?

A couple of weeks ago I was asked a similar question on BBC Tees radio and the answer is something like "quite". The BBC recently reported that government agencies in the US and UK have cracked the algorithms used for banking and email and, I think more importantly, that some companies leave "backdoor access to their security systems" for security agencies (source: http://www.bbc.co.uk/news/world-us-canada-23981291).

Let's be clear about Internet security, even the U.S. military gets hacked and whilst I don't know what security they use I am sure it's more complex and expensive than you or I can afford to set up.

So what can your average SME do to make their website safe if they are storing or processing sensitive information? The key steps are:

• Ensure all software and operating systems are up to date so that security holes are patched
• Encrypt sensitive information that is stored such as credit card numbers and passwords using hashing functions and a random salt that adds some random element to each of the encryption functions
• Ensure passwords have some kind of control over length and the characters used
• Don't store passwords in written format
• Don't give out passwords to anyone else
• For the transmission of sensitive data transmit use a secure connection (look for https and the padlock on your browser)

Will that prevent your website from being hacked - the answer is no, if the US military can be hacked then so can your site.

So what's the point? Firstly, your site is secure but the sites of many others are not and it is simply easier and less risky to hack into their sites. Secondly, it will be difficult, time consuming and very costly to hack your site and probably not worth the effort based upon the return.

The theory of web security boils down to making the cost of breaking into a secure website very high, the process very difficult and significantly more costly than the returns gained from hacking into a site. Encryption of data, which forms the central part of such a strategy, is a very complex mathematical process which makes it very difficult to determine how it is achieved even if someone has access to the encrypted data. However, it is a mathematical process and as computing power increases rapidly the encryption methods of a few years ago can now be cracked fairly quickly making it a continual battle to stay ahead of the bad guys.

Large organisations throw money at Internet security and employ ethical hackers, essentially people who have switched sides, to test their security - it is a costly process, that is beyond the means of most. Us mere mortals can only afford a good level of security that in most instances will protect our websites.

For me the scary part of the BBC story is the note that backdoor access is provided for government security agencies and that may include banks and the like. I'm no longer worried about the government having access to all of my data. Whilst I don't want them to have it, I have long assumed that they do. More importantly, if there is backdoor access then there is a huge security hole that is also available to hackers which makes the whole system highly vulnerable as the returns may well be worth the expense for complete access to a banking system.