<http://schema.org/articleBody>
"As more consumers move online to do their shopping, the ecommerce industry continues to boom. U.S. consumers spend around $1,200 - $1,300 per year, and that number is expected to almost double by 2016.\nThat increase provides even more opportunity for hackers. The data breach investigations report estimated 174 million compromised records, 81% of which utilized some form of hacking. That's 170 million more than in last year's report.\nSecurity measures should be the most important factor stressed in ecommerce. In order for brands and consumers to prevent attacks, they need to understand what's at stake for the brand, the consumer and the hacker. \nWhat's at Stake?\nWhen a hacker steals a consumer's information from a company database, who pays the ultimate price: the consumer or the brand?\nThe brand is held responsible for securing the customer's information. If that privacy is breached, the customer suffers consequences such as identity theft, stolen credit cards, bank accounts and other information that's of value to the hacker. \nOnce a customer's information is stolen, the consumer must quickly report and cancel all accounts. Generally, the bank or company reimburses any compromised activity \u2014 this puts the consumer at a major inconvenience, but holds the seller financially accountable. \nScot Terban has been a security consultant (formerly known as an \"ethical hacker\") since 1996; he's worked for IBM's global security services group since 2000. \nAccording to Terban, both the consumer and the brand are at risk, though there are more concerning calculations for the latter.\n\"The consumer has the risk of losing money either by theft of service (use of their accounts or credit cards/bank accounts, etc.) but often are reimbursed by the bank if the card has been compromised in some way. Now, if a site (company selling a service) is the source of the compromise \u2014 and it can be shown now that they have not made the proper strides to protect their clients' data \u2014 then they may end up footing the bill in some cases as well as garner large bad press on the incident and their services,\" says Terban.\n\nSEE ALSO: Former Hacker: Today\u2019s Hacks Are All About the Money\nWhen a brand is hacked, they're not only left with financial damage to clean up, but also their reputation. Take LinkedIn, for instance. The company took a severe blow after more than 6 million of its users\u2019 passwords were leaked online in June. LinkedIn quickly confirmed and apologized for the password breach, but was sued for $5 million.\nStratfor, an Austin-based company that concentrates on security issues, was hacked by Anonymous in 2011, resulting in stolen emails and credit card data. The group's alleged Twitter account @YourAnonNews, tweeted that it was able to steal credit card data because Stratfor had not encrypted the information \u2014 an embarrassing mistake for a company specializing in security. \nThe risk factor between the company and customer also depends on what's at stake for the hackers themselves. Most prefer the least amount of risk, but there is always the chance of getting caught.\nSteve Santorelli is a former detective with Scotland Yard and investigator at Microsoft. He is currently director of global outreach at a cybercrime research company called Team Cymru.\nSantorelli compares the hacker's initial decision to break into a computer or its network to an ROI. \n\"How much time and effort does the miscreant need to spend to get what size of reward? What's the easier route to the maximum pile of eventual cash?\" asks Santorelli.\n\"Spending months planning and executing an audacious attack on an accounts payable department might make sense if you can extract seven figures of reward\" he says. \"Compare that to the average phishing attack \u2014 which now lasts a few hours and nets less than a handful of victims, likely with limited funds if they are regular account holders.\"\nWhat Consumers Should Do\n\n\nThe most common mistake for consumers is to assume that a product which has a \"hacker proof\" logo on it will actually keep a hacker out of it. \nIn the event that your data has been hacked from an ecommerce database \u2014 depending on what data has been given to the site \u2014 Terban suggests that the consumer do the following:\n\n1. If you have a credit card number saved in your profile, you should alert the bank and have a new credit card sent to you after cancelling the compromised one.\n2. If your email address is a primary one that you use for everything, be aware that it may now be fodder for \"Phishing\" attacks on you for more information. Make sure your spam filters are working and always think before you click links or open files sent to you in that account.\n3. If the site collects personal data, such as date of birth or (and this should not happen) your social security number, then you should obtain some identity theft protection that the company which lost your data should pay for. This will alert you if someone is trying to open new accounts as you obtain the data they have stolen.\nWhat Businesses Should Do\nBusinesses commonly make the mistake of neglecting to monitor and maintain the security of their site, and software and other tools are constantly evolving. Both Santorelli and Terban agree that sites often are attacked when they fail to keep good hygiene. \n\"Web and mobile application developers are often not savvy to payment security requirements and secure programming methods, which can create security holes that can be exploited by hackers that look for high value targets, such as ecommerce sites,\" says Greg Hammermaster, president of Sage Payments.\n\nSEE ALSO: 7 Mistakes to Avoid on Your Ecommerce Site\nSecurity should also be an important factor when mapping out the design goals of a website. Most sites do this with an SSL security certificate. You can purchase a certificate, or there are some ecommerce platforms like Shopify have a default built-in SSL upon checkout. \nPerhaps the most effective way to protect your business from hackers is to think like a hacker. Terban says the best way to do so is to hire one to protect your network and infrastructure.\n\"This is not always the easiest thing to do because you really need someone you can trust and who knows what they are doing,\" says Terban. \"Accreditation in the Information Security business is getting better, but, in general find someone who can prove their technical worth, as well as having a proven track record in either the defense of networks or the penetration thereof.\"\nImage courtesy of iStockphoto, maxkabakov\nImage courtesy of Wikipedia\n"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2012/10/09/ecommerce-security-tips/>