by Joseph Neathawk
Security Programming & Development Specialist
Fanning Communications, Inc.
Brute force attacks aimed at hacking into a website simply cannot be prevented. If your website has a login page, it is only a matter of time before a programmed bit of malware or some human hacker finds your page and attempts to break in. Given enough time, most brute force attacks will succeed, although, in the case of highly secured sites, it may take years. From a security perspective, that is the goal; to force hackers to spend so much time making failed attempts that by the time they would have succeeded, your website has already been updated and now they have to either quit or start their attack again from the very beginning.
While strong passwords will help delay breakins, clients often ask if that is all that can be done to protect their websites? In fact, if your website is being hosted by Fanning Communications, other things can and are being done, often behind the scenes, that assist in keeping bad guys out of your website. Fanning Communications is one of the few website development and hosting firms that maintains an active and on-going security program dedicated to protecting the websites we host. As part of this security effort, we often instantly black-list the IP address of a computer we find attempting to hack one of our clients’ sites. This works well if a hacker is using a single IP or a small number of static (specifically assigned) IPs. Unfortunately however, the vast majority of brute force hacks employ a wide array of dynamic (shared) IP addresses. Typically these type of attacks make a single attempt before swapping to a new IP. In the case of dynamic IP addresses, which are shared by many users of the Internet, blacklisting the IP means that innocent users assigned a dynamic IP address that has been blacklisted, may not be able to connect to websites they wish to visit.
Continue reading “How We Work Behind the Scenes to Protect Our Clients Websites”