One of the questions I hear a lot is, "what’s the common factor you see with breached customers?" and the simple answer is, unpatched / out of date software. In this blog post I'll walk you through a few tips that can be used to help mitigate breaches.
A large number of customers we deal with often wonder why they have fallen victim to a breach; however, most of the time there is a common reason behind why they were targeted. Here at Foregenix we constantly perform investigations, both within the payment industry as well as beyond, in a general Incident Response (IR) context. Most of the time, there is a common factor throughout, environment to environment; specially within the eCommerce space. This common factor is essentially out of date or unpatched software. Unfortunately, this lack of patching and maintenance tends to be the reason they get breached.
Lately, Foregenix has seen a large number of unpatched Magento websites that have been breached because the framework has been left to wither. On February 13th 2022, Adobe released a rather critical patch to combat a weakness commonly referred to as the template vulnerability - https://helpx.adobe.com/security/products/magento /apsb22-12.html. The patching process was a two part process with the second patch released on February 17th 2022; however, during a number of our investigations we are seeing that either the merchant failed to patch the vulnerability entirely, or they only applied the first part of the patch which meant they were still vulnerable to attacks.
Below are a number of simple things that Foregenix recommend be performed on a regular bases in order to help mitigate breaches:
2. Implement a password policy that covers the following:
You can also check - and monitor - your website security status using our free ThreatView Community service:
While a number of the recommendation made above may sound simple, they can be very effective in helping prevent an attack on the website. One of the sayings I tend to refer to when speaking to impacted customers is “you don’t have to outrun the bull, you simply need to outrun the person next to you”. It may sound horrible, but when you look at the statistics, attackers simply target those websites that are susceptible to vulnerabilities rather than trying to exploit the unknown. A lot of the time, the attackers will simply monitor the patch notes and security bulletins for frameworks like Magento or Wordpress and then scan the Internet for websites with those vulnerabilities and once detected, exploit them. By implementing a simple update policy that ensures critical security patches are applied within a month, you could be making the difference between your website being targeted or being left alone.
If you think you might have fallen victim to a breach, do not hesitate to contact us here at Foregenix.