The smartness of the cyber attackers lies in the fact that, they mostly (or the smartest of them) attack your website or web-application through different layers of internet. See, I told you, internet is the network of interconnected computers. Web is one of the services on the internet. As our website communicates between client (browser) and server ( a remote computer) the information passes through all the layers of internet. Web designers or developers mostly work on the application layer where the code for the website is executed however, all the information passes essentially through all the layers of internet. And this is where the data is intercepted mostly. Most of the attacks takes place in and through the Network layer of internet. Let's discuss some common and some special attacks and their mitigation and protection.

 

There are in general two types of Cyber-security threats that we should be most aware of:

​

1. Traffic related threats. Some popular attacks are:

       A) DDoS ( Distributed Denial of Service) - A DDoS attack overwhelms the server with a huge amount of traffic. This traffic is illegitimate and makes your website slow or unresponsive for legitimate users. Hackers may compromise many computers physically through a trojan horse virus ( a malicious link to your computer which when clicked installs the virus in your system and the hacker gains the control of it). When this is done, they use all those compromised systems to throw a request to your website overwhelming your server thus.

​

Mitigation: Cloud service providers like Vercel have protection against these attacks for free with hosting. In the server dashboard you can find and manage it effectively. Also, cloud solution providers like cloud fare have paid protection against such attacks which is highly effective and one of the best in the industry. Integrating captcha to identify malicious bots is one of the strategies.

    

      B) DNS spoofing - This is another very common and dangerous form of attack. In this case, the attacker alters your DNS records to redirect the traffic to another website when a user tries to access yours. There is no data breach of yours in this case but you end up losing the users' trust. This is also called DNS cache poisoning. So basically your server/host where your website is deployed is your DNS as well. However, one needs to be really smart to perform this action.

​

Mitigation: Cloudfare has a solution to prevent DNS spoofing. Let's discuss more about it. Here I am just giving you some basic information.

​

    C) Interception - There are several ways the data in transit can be intercepted at different layers of internet where the network layer being the most vulnerable one. This is also called Man in the Middle attack. One way is when the connection is not secure which is when we are using HTTP instead of HTTPS. When data transits through Internet using HTTPS protocol, the data is encrypted. So, a hacker even gets the access to the data, can not decipher it and it's of no use. So, the first step is to always choose HTTPS transmission protocol and that happens by getting the SSL certificate which your host provider provides you for free. There is nothing extra that needs to be done from your side. However, hackers these days have found a way to decipher even the HTTPS traffic by SSL stripping or by somehow presenting you a fake SSL certificate and that is a serious concern for data breach. Sensitive information can be leaked and misused in these cases.

Another way is your Internet Service Provider having the access of it for malicious reasons. This is also possible. 

See, at this point, when a hacker can even decipher the data in transit secured through a SSL using HTTPS protocol, no one can do anything to save your data accept - "your developer/engineer/designer/architect."

​

Mitigation - The only way to mitigate such a hacking is Encryption. Let's understand this. Data for your website or your web-application has three states in terms of flow on internet - 1. Data in use - This is when the user is interacting with your website on their personal machine. 2. Data in transit - As data flows over internet between client (user) and server. 3. Data at rest - Data in database. Any sensitive or important information that you do not want to get leaked, must be encrypted. Now, when you encrypt it, from your side with strong encryption mechanism and algorithms, the data becomes impossible to decipher even if intercepted. The main thing here which is more than the algorithm is "encryption key management". The standard practice is to not let your key which is used to decipher the data so that end user can read it, flow over internet. And here comes the architecture of your website in picture. You design the entire website (data flow) and encryption in such a way so that the key doesn't flow over the internet and is safely kept on your server (which we also say cloud ). And then it is on you as a business owner or administrator to ultimately make sure that the key has only authorised access. Your architect can help you here as well combined with your business administration. 

Another important design principle that comes in play here is web token designs and url designs. See, url is an exposed entity on a network or a user's computers. if one has an access to a url, they have the access to he web-page. or just making some changes in the url, they can gain access to some important user data on your website. So, designing proper ids of data, encrypting the url, and token management like OTP, Passwords, and other authorisation techniques need to be architected well. This is a basic information for you. Join my newsletter to learn more.

End to End Encryption known as E2EE is a method where we make sure that data is encrypted in all states of flow - in use, in transit, and at rest.

​

2. Direct attacks on your website: Some popular ways are:

   A) SQL or NoSQL injection - In this case, the attacker's motive is to gain access to your database. Now, there are fields in your website let's say that a user enters. The attacker can come like a user and enter some code in this field. That field is connected to your database essentially. The attacker smartly enters a code that  that disturbs the entire database SQL or NoSQL. One has to be an expert engineer to do so. This is not easy to do. But this is dangerous. This can destroy your entire database. 

​

Mitigation - For this the database has to be "properly" , "neatly", and "tightly" integrated into the architecture of your website. One way is sanitisation of data. The developer or designer writes the code in such a way that no user can enter any "code" into the input fields and only sanitised data is fed to the database. This is completely an engineering based solution.

​

B) XSS (Cross-site scripting) - This is a dangerous way to attack a website directly. In this case, an attacker can directly inject javascript code to your website which when is accessed by another user, executes and impacts your website in a harmful way. Session tokens like cookies and other sensitive information from a user can be stolen by this. Another important step to take here is input validation. Always ask your engineer to perform these two things when dealing with databases.

​

Mitigation - Engineering is the only solution here. The website must be written in a way so that Cross-site scripting becomes impossible. This is hard to explain here as it is all engineering but tell your engineer about this and make sure measures are taken to protect this. Stopping such an attack is possible. However, latest frameworks and servers have potential solutions for this and they do not allow engineering (code) which makes the website vulnerable for such attacks.

​

So, these are some common cyber attacks. Other attacks are possible simply by gaining access to someone's computer and if that person whose computer has been compromised, visits your website the attacker makes harmful impacts to tour website through that. But at the same time it is not like, these attacks can not be avoided. With proper architecture, design, and engineering any kind of cyber attack can be avoided and challenged.

​

As an owner, you must be aware.

​

​

​

​

​

​

​

​

​