The Podcast That Explores Digital Strategy
Hey guys, here are some of the links that we talked about in Episode 8: The Flexible Strategist (Strategy Talk with Matt O’Bryant)
Enjoy!
As a strategist, we need to have good information from good sources to make good decisions. Here are a few strategic trend reports that I found really helpful in deducing some intelligent insights about the tech space.
Accenture Technology Vision 2016
Future Today Institute 2016 Trend Report
Today is an auspicious occasion! It marks the first of my Strategy in Context series. As well as my first try at micro-blogging. I have a lot of information on topics like strategy, research, account management, user experience, and more. I’d like to get that information to the public as quick as possible while still posting good, quality content. Now, I’ll most likely expand on this series in an eventual strategy whitepaper.
I was recently at a tech conference asking people for strategy resources. One person firmly told me that “no one’s going to give me their strategy resources (or process for that matter) because that’s how agencies make the big bucks.” So, okay… that makes sense to me, but it doesn’t mean I can’t give away my strategy resources.
I’d like to address any nay-sayers about publishing digital strategy process, tactics, and/or resources. I come from the open source world where information is shared and the community benefits from that. This is my attempt to give back. I am more worried about people saturating the internet by building shitty things people don’t need, than I am about someone stealing my strategy process, theories, and thoughts. Plus, I want to spark discussion, so let’s begin.
I’m sure everyone is familiar with context-aware design, yeah? It’s when a device (like a smartphone) changes based on the environment in which it’s placed. Our smartphones can make recommendations based on location or auto-adjust the contrast on a bright day. Strategy in context is similar in the sense that we (as strategists) need to take into consideration our environments. And hopefully act accordingly.
Implementing a strategy process can be a daunting practice.
So, how do you conquer a client, project, or product when you aren’t sure how to proceed? You take a step back…and look at things from a holistic standpoint; from a bird’s eye view.
In order to understand strategy, there is one truth you have to realize: true strategy is continual, it’s not an end-game and never will be. The digital strategy that works for you today, might not be the one that works for you tomorrow, let alone a year from now. And this is why strategists are commodities, because it’s a job that never ends in the web and mobile space.
Holistically speaking, digital strategy is dependent on all its players. It is so entangled with other strategies that looking at it any other way would be a disservice to both you and your client.
The elements of strategy:
Contingent on each of these elements, strategy will have different meanings depending on its context. It’s too much to take in in a micro-blog post, so as the Strategy in Context series continues, I’ll drill into each one of these areas to give insight into breaking down your strategy process.
At any given moment, there are hundreds of tiny shifts going on in the digital world. Developments that are slowly (or quickly) moving in from the fringes toward the mainstream. A fantastic trend report by Future Today Institute highlights innovation that is making it’s way toward being the established norm. Innovation is often talked about, but overlooked when it comes to strategy positioning.
In order to understand the information spectrum, you first have to understand all the new technologies, trends, and innovation taking place right now. But there are flaws in that thinking as one new technology supplants another. So, first thing you need to do — start building an information database. For all you strategists out there, you need some type of system where you can gather information and access it easily. I’ve built myself TheWebward.com – I call it my morning business review, but it’s really an information database.
You can try RSS aggregators like Digg Reader or create your own. But keeping up-to-date with the technology landscape is your first lesson in strategy. Did you know Baidu is leading the way in conversational interfaces? Or that Blockchain can help fight cyberattacks? Do you know what Blockchain is?
As you begin your journey into strategy, you may feel lost at times. It happens to everyone and that’s okay. But if you’re lost and can’t find answers, look to other industries. One thing that’s helped me tremendously in developing my strategy process is turning to other sectors that have had strategists for decades. The military, politics, and the intelligence community all have resources on strategy out there that you can research. Then take their core principles and apply them to the digital space. Again, I’ll go into this more in upcoming posts, but I feel like this isn’t really a micro-blog post anymore!
Ok, more to come on Strategy in Context.
I know I’ve used this clipart before that’s in the featured image (maybe I like it!), but because the Guy Fawkes mask has become synonymous (thanks to Anonymous) with web hackers and in turn with website security, I found it befitting to use once again.
This post is in direct relation to the talk I am about to give this Thursday for NIM on helping people overcome their website security insecurities. I will post the slides by the end of the week.
Ever since I’ve been in the field of website security, it’s taken me a while to understand it. Working for Sucuri definitely helped in understanding it —but when I first started I did NOT get website security. It made no sense to me. And I’m a guy who comes from the agency world. I used to do front-end development work, I know design process, development process. That makes sense, you take one step forward and get closer to your goal…hopefully. Not in website security, you side-step constantly. Because it’s not about control. Website security is a combination of technology, process, and people. You can’t control all those things, you can assess and mitigate risk in those areas, but you can’t control.
The motivation I have for giving the talk is two-fold:
So…I guess you could say my hopes for this post/talk are that the audience picks up one (hopefully more) tidbits of information that will make them more diligent online. I want people to understand website security a little better and to give them a plan of action to get their website security and online posture in order.
Let’s begin
The first thing I need everyone to understand is that website security involves several things. It involves Technology, Processes, and the People:
So, the point is, we can’t control everything, but we can mitigate the risk.
hack·er ~/ˈhakər/ (noun): a person who uses computers to gain unauthorized access to data.
Originally ‘hacker’ was a term of esteem, used to describe someone who tinkered around with systems and could break things down, reverse engineer, someone who was really good at understanding their system (whatever it was). Now it’s used to describe someone who wants to do malicious harm online.
HACKERS: White-hat, Black-hat, Grey-hat , Blue-hat. There are different types of hackers.
Motivations of hackers:
For the most part you’re going to see two types of attacks. Automated, which make up the vast majority of the attacks that are out there. Then the less frequent targeted attacks. The targeted attacks are the ones we hear about and read about in the news headlines. But the ones we really need to worry about are the opportunistic or automated attacks. Given enough time, attackers can sit back and have their networks work for them, and have their scripts slowly find, test, and attack every available target on the internet. Malicious automation has gotten increasingly sophisticated and shows no signs of slowing down.
You can download Sucuri’s Q1 report on hacked websites here: https://sucuri.net/website-security/website-hacked-report
It’s pretty scary stuff, but to give you a precursor, Google reported in March of 2015 that 17 million website users had been greeted with some form of malware warning that the websites visited were either trying to steal sensitive information or trying to install malicious software on the users’ computers. In March of 2016, that number jumped to 50 million!! I imagine next year that number will grow to triple, maybe quadruple that. You can see as the internet grows, so does malware distribution. Google, alone, blacklists over 20,000 websites per week, over a million per year. That’s pretty staggering.
But what are some of the vehicles for distributing malware? There are a lot, almost too many to name, but I’ll name a few that’s seen quite often:
There are others like XSS (Cross-site scripting), SQLi (SQL injections), RFI (Remote File Inclusion), LFI (Local File Inclusion), and more. So we need to be very diligent, things are already working against us.
A few things, right? Right now, we control our website (well, hopefully if you haven’t been hacked and locked out of your site), and what goes on it — things like themes, plugins, modules, extensions, add-ons…
We also control our hosting environment. And I want to make a quick note on how hosting plays a role in website security. Here is a picture of my CyberDuck (the FTP client) – I’ve blurred out a few of the domains I have on there (for security purposes).
The thing to note here, is that all these 6 sites, all these properties, they sit next to each other in your hosting account. It doesn’t make a difference to me if you have a dedicated server, a VPS, or a shared server. Most people have shared servers. Why? Because they’re cheap and they offer unlimited domains. I don’t think it’s much of an issue that people sit on shared servers with other people and “share” the resources, that’s not really the problem. Hosting providers will have their infrastructure set up so that it would be very difficult for malware or a virus to jump from one account to the other. But the issue it within our own hosting account.
Take the above picture. Say the two sites that are not blurred out – BeingAJiLe.com and AdamJamesLamagna.com – say these sites were really important to me (they are), but let’s say those are the only two I cared about on my shared server. The other 4 sites that are blurred out, let’s say I don’t care about them. Let’s say I never update (I do, but for argument sake). That means that those sites are susceptible through software vulnerabilities, or weaknesses in the code. If one of those sites gets infected, it could infect all the other sites on my server through an activity called cross-site contamination. I wrote a post on it. But remember this — your web host / server is only as strong as its weakest link.
Your web host /server is only as strong as its weakest link
And that’s how hosting plays a roll in website security. People put development or test sites on the same server as production sites, and then forget about those sites. Take a count of how many sites you have on your server, and do a little cleanup if there are sites on there that you don’t care about.
This is the thing, there’s really only 1 thing you can do to protect your site. And that’s to install a firewall, specifically a website application firewall. A firewall is a catch-all phrase, right? There are network firewalls, server-level firewalls, local computer firewalls, they all protect different things. You can read up on the Differences in Security Firewalls, it’s a good post. But a website application firewall, also known as a WAF, will protect your site from malicious incoming web traffic. What it does is inspects packets of data and compares it to known vulnerabilities and known trusted sources. If it matches a trusted source, it passes through, if it matches a vulnerability, it doesn’t.
But Firewalls, as all security technologies, are not infallible. They make mistakes, not very often, but maybe there’s a new virus that it hasn’t seen yet. It won’t pick up on it and block it from your website. But that’s the reality and why having a good online posture comes in handy.
Another technology you can use to get insight into what is going on already on your website is called a scanner, or monitoring device. There are a few free ones out there like these:
All pretty solid technologies, but again they’re fallible. They’ll check the source code and files and compare it to known vulnerabilities. If a vulnerability has not been discovered yet, it won’t pick up on it. But that’s just the way it is, so we have to be strong in our online posture to be able to react accordingly, and hopefully prevent infection from ever happening.
A few things (and let me preface this by saying ‘I don’t want to tell you what you already know’) that I want to impress upon you that are essential to good online posture.
You start with an asset inventory list:
Here are a few tools for you to put in your website tool DIY basket:
Platform Agnostic Scanners:
CMS specific scanners (HackTarget has got some cool tools):
CMS specific scanners will compare your install to a trutsted install of the specific CMS to see if things have changed much, etc. It’s good to see if files have been changed or if there’s something on your site that just shouldn’t be there.
Reasonably priced Firewalls:
If you absolutely can’t pay for a Firewall and need something free, then I’ll use a combination of Cloudflare’s free CDN service, and Wordfence (this is only for WordPress users) – they bill the plugin as the “most downloaded security plugin for WordPress” – I feel like I’ve heard that before. But either way, this combination works really well for my sites, but keep in mind, my sites aren’t super high traffic. I imagine if you have a super high traffic site, that you can pay for a reasonably priced firewall.
But if you can’t, the above combination works for me. I use Wordfence’s automated scanning and Firewall, in conjunction with Cloudflare’s free CDN network (which will speed your site up regardless) and their security features. I also have two-factor authentication on my site and I use Login Lockdown which will limit Brute Force attempts.
I know this is all a lot to take in. Website security just isn’t one thing, it’s many. We were told that putting up a website is easy, and that’s true, it is easy. But managing and protecting and keeping your site/visitors secure on a daily basis is the hard part! It’s a constant battle, but I hope this brought a little clarity to securing your website and being a more responsible steward of the internet.
If you have any questions, please feel free to reach out! Many thanks!
People just expect their websites to be secure!
People just expect their sites to be safe, and I’ll admit, I did for the longest time too! But that’s a far cry from reality and one that’s hard to sell.
I work for Sucuri, one of the best website security companies on the market today (probably the best – and yes, I am biased!). But I sell web products to agencies and enterprise level clients. It’s not so difficult to sell them on our products. Sucuri’s products, they just work and very well at that! What I need to sell people on is website security as a whole, which is much more difficult than you may realize.
Let me break things down.
There are all these moving pieces to the web, correct? Yes, there are. Even more so at a granular level when you look at company’s servers or hosting environments, file structures and setups, their clients and others who have access to these sites, the sites themselves and all their vulnerabilities. Not to mention the hackers, who rarely leave a trace and rarely get caught and rarely get punished for it.
Let’s start with different environments. There’s a great analogy I use for shared hosting, VPS, and dedicated accounts.
So, this is a very simplified version of server environments. Nowadays, people use the term ‘server’ and the term ‘hosting’ in somewhat the same way. Years ago, when someone said we host internally, it usually meant that they had physical servers inside their offices where they would manage them and actually host their sites on those servers. And for those of you who don’t know, a server is just a computer, with a little different hardware on it (even though, a desktop computer could run a server) – I know, confusing!!!
Hosting is done by a number of different providers like WP Engine, 1and1, GoDaddy, Pantheon, and so on. They have the hardware and resources to handle many different types of platforms (or a specific one), and they also make things easy for people to manage their environments through something called a C-Panel or Control Panel. It’ll give you access to your domains (if you’ve pointed them from your registrar or used the hosting company to buy the domain) and let you change the directory path and DNS settings, things like that.
Now with most servers, there will be server-level firewalls set up with the infrastructure, but that means that it’ll still let in web traffic, which is what we need a lot of protection from. Port 80 (HTTP) and port 443 (HTTPS) traffic can let in a lot of different activity (good and bad). This is how your visitors reach your site, through one of those two ports depending on whether or not you have an SSL certificate. So, there are many different ways a website can get compromised.
And the list goes on…and on…and on…
But you have to be aware of this stuff, and keep in mind that a lot of these attacks are automated. Some may be done manually by a bored teenager sitting at home in front of his computer. But for the most part, they’re automated attacks. And keep in mind there are attacks of opportunity (which we are all susceptible to) and targeted attacks, which are usually for the bigger brands and companies, but make no mistake if you engage in controversial content on your website (like religion or politics), you can very well be targeted too!
There are a few different reasons why someone would want to attack your site or gain access to it. It’s not just money, but that can be part of it.
We have to be careful of things like Ransomware (holding a website owner’s site hostage) or Malvertisements (malicious ads) and there’s no one right way to do this. It really starts with education, so if you’re reading this post, kudos!
Some thoughts on general security
In order to keep your site (and your visitors) safe, you’ll need to explore general website security. Starting with monitoring and a firewall. Sucuri offers an awesome monitor/firewall package, our Website Security Stack. But if you can’t afford that, then look at all the free stuff out there.
You can use our Sitecheck to see if there is malware on your site. But keep in mind this only scans remotely, it can’t check the database.
You can learn how to harden WordPress. Which is basically locking a few things down like access, having containment, certain configurations.
Or you can take a look at OWASP and ModSecurity – which are open source and free to use, you just have to configure the firewall yourself, and that can get confusing!!
The Frustration of Website Security
And this is the frustration of website security—is that there is no 100% solution out there. I don’t think there ever will be! Ever! The reality is is that the landscape of websites and their environments change so frequently that once a solution had been produced, hackers have already found a solution of their own to beat it. And that’s the continual cycle.
So educate yourself and the people around you. If you own a website, you not only have a responsibility to it, but to your audience, and the web in general.
More to come on this topic…..