14,000 Indian websites hacked in 2012

It has been reported that over 14,000 Indian websites have been hacked by cyber criminals this year, an increase of nearly 57 percent from 2009.

Barry Shteiman, Senior Security Strategist from Imperva comments:

It’s important to note that not only is the man power relatively cheaper in India for European and American companies to hire they also have the skill set and therefore lots of effort globally is focused in India. However, this also means there is also a lot of focus by hackers that understand that the security practices there might be less maintained and therefore easier to target.

Not only that, the growth of website hosting in India has risen dramatically however their security focus on application security might not, since in growing markets you first try to achieve financial growth before considering controls. Historically controls are only added when pain is visible – 14,000 sites hacked is NOW a visible pain and action needs to be taken.

All websites serve either information and/or reputation facing information, or act as an application that is the business frontend for their clients. If breached, the risk of reputation hit or data theft is a big concern. In order to mitigate these risks, companies should deploy a frontend solution at the datacenter, whether its cloud based or at their own datacenters, that will be able to enforce proper business activity and application behavior and mitigate potential attacks and will provide a complete view on the attacks in order to allow security officers to respond.

At the end of day, simplicity and automation of that process will be key to ensure that a solution will be able to help fight threats, but will be business friendly.

However, deploying a solution is not enough, good security practices are also required. Code review, vulnerability assessments and secured coding policy are key to make sure that the applications and the servers that host them are secure, and are kept secure. Always check your ecosystem, and always look for changes, when they happen – validate that your controls are up to date. A secured system is only as good as its last penetration test results.