The CMS information security and privacy virtual handbook is intended to serve as your “one stop” resource for all things related to CMS information security and privacy policy. On this page, you’ll find links to all CMS information security and privacy policies, standards, procedures, and guidelines as well as computer based training, user ID assignment and complete instructions on what to do if you suspect that a security incident has occurred. The links on the left hand side of the page provide supplementary guidance on CMS policy, however, for a brief snapshot and high-level overview of some of our core programs, please take a look at the information provided below:

The file infector can burrow into executable files and spread through a network. A file infector can overwrite a computer's operating system or even reformat its drive.
The macro virus takes advantage of programs that support macros. Macro viruses usually arrive as Word or Excel documents attached to a spam email, or as a zipped attachment. Fake file names tempt the recipients to open the files, activating the viruses. An old but still prominent type of malware, macro viruses, remain popular with hackers.
Polymorphic viruses modify their own code. The virus replicates and encrypts itself, changing its code just enough to evade detection by antivirus programs.

Malware encompasses all types of malicious software, including viruses, and may have a variety of goals. A few of the common objectives of malware are:

Trick a victim into providing personal data for identity theft

Steal consumer credit card data or other financial data.

Assume control of multiple computers to launch denial-of-service attacks against other network.

Infect computers and use them to mine bitcoin or other cryptocurrencies.

Keep Software And Plugins Up-To-Date

Every day, there are countless websites compromised due to outdated software. Potential hackers and bots are scanning sites to attack.

Updates are vital to the health and security of your website. If your site’s software or applications are not up-to-date, your site is not secure.

Take all software and plugin update requests seriously.

Updates often contain security enhancements and vulnerability repairs. Check your website for updates or add an update notification plugin. Some platforms allow automatic updates, which is another option to ensure website security.

The longer you wait, the less secure your site will be. Make updating your website and its components a top priority.

Add HTTPS and an SSL Certificate

To keep your website safe, you need a secure URL. If your site visitors offer to send their private information, you need HTTPS, not HTTP, to deliver it.

What is HTTPs?

HTTPS (Hypertext Transfer Protocol Secure) is a protocol used to provide security over the Internet. HTTPS prevents interceptions and interruptions from occurring while the content is in transit.

For you to create a secure online connection, your website also needs an SSL Certificate. If your website asks visitors to register, sign-up, or make a transaction of any kind, you need to encrypt your connection.

What is SSL?

SSL (Secure Sockets Layer) is another necessary site protocol. This transfers visitor’s personal information between the website and your database. SSL encrypts information to prevent it from others reading it while in transit.

It denies those without proper authority the ability to access the data, as well. GlobalSign is an example of an SSL certificate that works with most websites.

Choose a Smart Password

With there being so many websites, databases, and programs needing passwords, it is hard to keep track. A lot of people end up using the same password in all places, to remember their login information.

But this is a significant security mistake.

Create a unique password for every new log in request. Come up with complicated, random, and difficult to guess passwords. Then, store them outside the website directory.

For example, you might use a 14-digit mixture of letters and numbers as a password. You could then store the password(s) in an offline file, a smartphone, or a different computer.

Your CMS will request a login, and you must choose a smart password. Refrain from using any personal information inside your password as well. Do not use your birthday or pet’s name; make it completely unguessable.

After three months or sooner, change your password to another one, then repeat. Smart passwords are long and should be at least twelve characters, every time. Your password needs to be a combination of numbers and symbols. Make sure to alternate between uppercase and lowercase letters.

Never use the same password twice or share it with others.

If you are a business owner or CMS manager, ensure all employees change their passwords frequently.

Use a Secure Web Host

Think of your website’s domain name as a street address. Now, think of the web host as the plot of “real estate” where your website exists online.

As you would research a plot of land to build a house, you need to examine potential web hosts to find the right one for you.

Many hosts provide server security features that better protect your uploaded website data. There are certain items to check for when choosing a host.

Record User Access and Administrative Privileges

Initially, you may feel comfortable giving several high-level employees access to your website. You provide each with administrative privileges thinking they will use their site carefully. Although this is the ideal situation, it is not always the case.

Unfortunately, employees do not think about website security when logging into the CMS. Instead, their thoughts are on the task at hand.

If they make a mistake or overlook an issue, this can result in a significant security issue.

It is vital to vet your employees before giving them website access. Find out if they have experience using your CMS and if they know what to look for to avoid a security breach.

Educate every CMS user about the importance of passwords and software updates. Tell them all the ways they can help maintain the website’s safety.

To keep track of who has access to your CMS and their administrative settings, make a record and update it often.

Employees come and go. One of the best ways to prevent security issues is to have a physical record of who does what with your website.

Be sensible when it comes to user access.

Change Your CMS Default Settings

The most common attacks against websites are entirely automated. What many attack bots rely on is for users to have their CMS settings on default.

After choosing your CMS, change your default settings immediately. Changes help prevent a large number of attacks from occurring.

CMS settings can include adjusting control comments, user visibility, and permissions.

A great example of a default setting change you should make is ‘file permissions.’ You can change the permissions to specify who can do what to a file.

Backup Your Website

One of the best methods to keep your site safe is to have a good backup solution. You should have more than one. Each is crucial to recovering your website after a major security incident occurs.

There are several different solutions you can use to help recover damaged or lost files.

Keep your website information off-site. Do not store your backups on the same server as your website; they are as vulnerable to attacks too.

Choose to keep your website backup on a home computer or hard drive. Find an off-site place to store your data and to protect it from hardware failures, hacks, and viruses.

Another option is to back up your website in the cloud. It makes storing data easy and allows access to information from anywhere.

Besides choosing where to backup your website, you must consider automating them. Use a solution where you can schedule your site backups. You also want to ensure your solution has a reliable recovery system.

Be redundant in your backup process — backup your backup.

By doing this, you can recover files from any point before the hack or virus occurs.

Apply for a Web Application Firewall

Make sure you apply for a web application firewall (WAF). It sets between your website server and the data connection. The purpose is to read every bit of data that passes through it to protect your site.

Today, most WAFs are cloud-based and are a plug-and-play service. The cloud service is a gateway to all incoming traffic that blocks all hacking attempts. It also filters out other types of unwanted traffic, like spammers and malicious bots.

How Often Should You Back Up Your Website?

Website backups should also be done on a regular basis, just like computer backups. The best case scenario is either daily or weekly backups, or around as often as you update your website. For example, if you only publish a single blog post per week and that’s the only update you make to your site, then weekly backups will suffice.

Why You Need to Backup Your Site

Backing up your site is the only way to ensure you’re protected from losing all the work you’ve put into it. And losing your website can have big consequences.

If you have to build a new website from scratch, you lose the time and cost involved in creating an all new site. That’s not a small thing. And if your website had a lot of pages or an active blog, you may be unable to recreate some of the content you worked hard on—a portion of your website could end up being gone for good.

If you run a business site, then you’re losing revenue for the entire time your site is offline. For an ecommerce business, the losses could be huge, as no one will be able to make purchases at all until you get it back up. For a service provider, a broken website at best makes you look unprofessional, and could also lose you potential clients that can’t find your business while it’s down.

On top of the consequences in time and money, you have to deal with all the stress, frustration, and embarrassment of solving an avoidable emergency. The emotional cost of losing your website without a backup may be harder to measure, but shouldn’t be discounted.

How Website Backup Services Work

Website backup services ensure backing up your website requires very little work, many of them by making the process automatic.

Websites have a lot of moving parts and a variety of files required just for your website to load the right way. Forget to backup a crucial file and your website might not load properly. If you’ve ever played around with the code of your own website, then you’re probably familiar with how changing a single line of code can bring your website offline. Yeah, not fun.

When you use an online backup service, you don’t have to worry about individually backing up each website element and file yourself. The service does it automatically in the background. This helps to ensure that every single file is included in the backup, and you can restore your site with a simple click if the need arises.

You need only choose your online website backup service of choice, configure it to your website, and choose the frequency. The application will run in the background, silently backing up your website’s data to your preferred guidelines.