Website Security Audit
Service Description
As e-shops and mobile sites become popular, more and more merchants adopt diverse ready-to-use platforms to set up their own online stores to extend the sales reach to customers worldwide with the ease in payments. Nevertheless, hasty launch of shopping sites without careful consideration of security may expose vulnerabilities to criminals.
Austreme offers Website Security Scanning and Audit which examines the entire merchant website, applications and web servers to discover security flaws, loopholes and vulnerabilities that hackers may make use of to attack. The scanning and audit procedure is simple – merchants just need to provide the corresponding domains and Austreme will provide a full report with findings and advice for corrective measures. We can quickly identify website security issues and test it constantly to keep merchant safe.
Scan Quarterly, Stay PCI-Compliant
Online merchants are especially recommended to perform PCI Security Scanning regularly since many of the small merchants have lax security for cardholder data. It poses big loopholes that criminals or hackers may exploit and attack the merchant sites. Failure or no measures to tackle the problem may lead to security breach and endanger the business by:
- Termination of ability to accept payment cards
- Sales loss or even business shut down
- Legal costs, settlements and judgments
- Fraud Losses
Our Website Security Audit is based on a sophisticated vulnerability assessment system and performed by Approved Scanning Vendors (ASVs) quarterly to fulfil PCI compliant requirements. Qualys (Certificate Number: 3728-01-10) is the ASV that Austreme uses to provide scanning services. It is one of the organizations that validates adherence to certain PCI-DSS requirements by performing vulnerability scans of Internet facing environments of merchants and service providers. It scans and tests the equipment that hosts merchant websites and checks all pages in the website for vulnerabilities.
Four Steps to Go
Step 1: Deploy
Website Security Audit is performed using a cloud platform that enables online merchants to deploy immediately and attain compliance as quickly as possible. No hardware setup is required and it is always up-to-date by adding more apps anytime throughout the world. It provides centralized management across apps and multiple, unified solutions with one console to perform vulnerability management, web application security and more.
Step 2: Scan
The crucial part of audit is the comprehensive scanning which includes network perimeter scanning as well as web application scanning in order to provide assurance that both network and web applications are highly secure. There is a Web Application Scanning module provides users an automated tool for evaluating web applications before and after development ensuring that applications are built and maintained in a secure way. It allows users to:
- Scan vulnerability types within any built/customized in-house/purchased application
- Crawl web applications
- Identify cross-site scripting vulnerabilities
- Isolate SQL injection attacks
- Conduct authenticated and unauthenticated scanning
Step 3: Remediate
To achieve compliance, businesses must identify and remediate all critical vulnerabilities detected during the scan. With a comprehensive scanning report, merchants are acknowledged of the identified vulnerabilities that cause the failure in complying with PCI-DSS. Detailed instructions with links to verified patches are provided in the report so that site owners can quickly eliminate respective threats discovered.
Step 4: Submit
Site owners can submit the compliance report to acquiring banks or use to assist in remediation efforts internally.
Benefits
One-stop security audit service with no hardware, software or installation required
Reducing the risks of fines, penalties and higher subsequent costs of compliance
Avoiding non-compliance and lawsuits
No interruption to existing website operation, transaction and payment process
Building buyer confidence and trust towards merchant sites
Detailed report for submitting to acquirers
Reviewing service vendors and web security status after the health check and corrective actions
