“Website” Meaning for Startup CEOs?

You might hear a lot of CEOs saying, “My website is powered by WordPress”, “My website is everything”, or “My website is my entire business!” These are the most common answers from CEOs. Almost all startups operate their own websites. Many startup CEOs build their websites with CMS tools such as WordPress, Joomla, or Drupal. Those that depend on these tools really need to pay attention to what these are, if they have any hope to do business online.

Well, the actual definition of a website is a connected group of pages on the Internet that use unique addresses and network routes, which are based on Internet protocols. But who can actually understand this kind of explanation? A website is web data, with web pages and contents. To get a better understanding of what a website really is, we can start by knowing more about CMS. A ‘web content management system,’ CMS is a tool that processes many raw contents into useful resources in this content-filled world. This is the leading solution to building a website without any difficulties. Methods of protecting a website can differ completely depending on the beliefs of the startup CEO. One CEO may want to protect a site one way, and another CEO may think differently and protect a site another way. It all depends on their definition of what a website is to them. Here is a closer look at common assumptions CEOs have about websites.

1. ‘My website is powered by CMS’

CMS and all related plugin modules are website building and operating tools. Building security with an application can be done by secure coding. However, secure coding may not be perfect. That’s why CMS services release security patches and updates. Users need to constantly update. Still, a website can get ‘zero-day attacks,’ that brief period of vulnerability when the hacker can attack before the CMS vendor finds out.

The point here is that, not limited to CMS services themselves, users also need to pay attention and double-check every module to see whether it is really safe or not. Modules should only be downloaded from reliable, trustworthy websites. It can be quite bothersome to constantly update and still be vulnerable to attacks.

2. ‘My website is all the data stored in the data center’

Technically, this is a pretty close answer. A website is data, and website data is stored at an Internet data center, IDC for short. To keep data safe, the data center administrator manages an application firewall and network security tools such as IDS/IPS to prevent hackers, viruses, and malicious codes from entering the data center.

Enterprises can usually afford to directly manage their own web server in the data center. But most startups can’t do this, so they rely on their hosting services to manage it for them with a lease of a partial web server in the data center. Cloud hosting services are popular among both small and medium businesses and larger enterprises. But if users use a cloud hosting service such as AWS, there is nothing the user can do about data center security. The data center will probably be safe, but the security is built around the server, and not the individual websites.

3. ‘My website is my own private data with web pages’

This is how startup CEOs should perceive their website. Understanding this concept is important because among security attacks on information, 90% of attacks are aimed at contents, through contents. Compared to the vulnerability of CMS and physical data storage, content vulnerability is a more serious matter. Website attacks are directed at the contents of a website. The contents are not necessarily images or files, but may include account information and administrative authority.

So, how can startup CEOs with CMS protect their websites?

Websites to a business can take on a completely different meaning from the average user. Startup CEOs might view a website as their gateway to the outside world. It is their vehicle to communicate their business and sell products. In essence, a website is a business. Most websites are powered by CMS systems and since there’s no way to know how secure CMS apps have been coded, they just need to constantly update the security patches provided by CMS to avoid attacks like SQL injections. Still not completely safe, CEOs need a web application firewall that covers all the vulnerabilities of CMS’s own security measures.

Even if a cloud-hosting service protects the web server or its data center, it does not protect the contents of individual websites. Basically, the data center manages the antivirus role and the network security role, but it does not take the web contents security role. Technical and privacy issues restrict it from securing web content.

A web application firewall (WAF), on the other hand, can fully protect website content. The cloud-based web application firewall Cloudbric can protect your website. Even if your data is stored safely on an IDC, or if you update security patches constantly on CMS, you still need a WAF to fully protect your website.

This blog post was originally featured on cloudbric.com. Visit their blog for more insight, news, and accessible information on web threats and trends. If you would like to learn more about Cloudbric’s logic-based WAF service, please contact info@cloudbric.com.