Effective website security

May 2014 Information Security

Websites have been using SSL technology for years to ensure their security, and the certificates and their uses are well understood. SSL that only protects users at login, however, leaves them vulnerable when they’re spending time on your website.

“SSL,” says LAWtrust Certificate service manager Megan Rehbock, “is like a safety belt for secure websites and it should always be on across your entire website to protect your users with persistent security from login to logout – be it via Web browser, mobile device, e-mail client or other Internet applications.”

Always-on SSL is an essential and cost effective measure that provides end-to-end protection for website visitors from start to finish, making it safer to work, socialise and shop online, she says. Always-on SSL encrypts all information shared between a user and machine, including all pages and cookies. It is not a product, service or replacement for your existing SSL certificate but rather an approach to security that recognises the need to protect the entire user session, and not just the login screen or home page.

Persistent HTTPS throughout your site and Always on SSL is not difficult to implement. Here are a few tips:

* Scan for and replace all instances of 'HTTP' with 'HTTPS' on your website.

* Remove mixed content – make sure to ensure all content displayed on your website originates from HTTPS links. HTTP references could compromise the security of your site.

* Only allow HTTPS connections to your secure website.

* Set your cookie flags to 'secure'.

* Enhance security and trust with Extended Validation SSL Certificates.

* Never use self-signed SSL certificates, only use certificates issued by a trusted certificate authority (CA).

* Disable null ciphers, short bit lengths and SSL version 2.

* Make sure that your CA signs and issues your certificate using SHA-2 hashing algorithms.

Vulnerabilities such as session hijacking, side-jacking, and man-in-the-middle attacks are some of the risks you expose users to if you do not implement always-on SSL. Implementing always-on SSL will help give users the assurance that you take their security and privacy seriously, and that you are taking reasonable steps to protect their identities and private information.

For more information contact LAWtrust, +27 (0)12 676 9240, [email protected], www.lawtrust.co.za

Share this article:

Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...

The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...

POPIA non-compliance puts municipalities at risk
Information Security Government and Parastatal (Industry)
Digital responsibility must go beyond POPIA compliance to recognising that privacy and service delivery are fundamentally linked. Despite this, only 51 out of 257 municipalities submitted their mandatory data protection and access to information reports in 2024.

Read more...

Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...

Most wanted malware
News & Events Information Security
Check Point Software Technologies unveiled its Global Threat Index for June 2025, highlighting a surge in new and evolving threats. Eight African countries are among the most targeted as malware leaders AsyncRAT and FakeUpdates expand.

Read more...

Welcome to the new cyber battleground
Information Security
The Iran-Israel conflict is rapidly redefining modern warfare, pushing the boundaries of cyber capabilities and creating a new, borderless digital battlefield. Fortinet’s CISO, Dr Carl Windsor, offers a critical, in-depth analysis of the escalating tactics and global implications in his latest report.

Read more...

African industries may overestimate cyber defences
Information Security
] A significant perception gap exists in security awareness training: 68% of leaders believe training is tailored to roles, yet only a third of employees feel adequately trained. Many organisations only conduct annual or biannual generic training that may not effectively change behaviour.

Read more...

SMARTpod talks to Sophos and Phishield
SMART Security Solutions Technews Publishing Sophos Videos Information Security News & Events
SMARTpod recently spoke with Pieter Nel, Sales Director for SADC at Sophos, and Sarel Lamprecht, MD at Phishield, about ransomware and their new cyber insurance partnership.

Read more...

Cybersecurity and insurance partnership for sub-Saharan Africa
Sophos News & Events Information Security Security Services & Risk Management
Sophos and Phishield Announce first-of-its-kind cybersecurity and insurance partnership for sub-Saharan Africa. The SMARTpod podcast, discussing the deal and the state of ransomware in South Africa and globally, is now also available.

Read more...

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...

Categories

Effective website security

Further reading:

Published by Technews