Security – Page 5 – Wingrove-Services

Updated for May 2018

Somebody shared with me a PDF offer from their hosting company offering to check and lock down their website for a single payment of £497, and proposed that this would be suitable evidence to the ICO office if they ran into problems later that they had tried to meet the requirements of GDPR. I have seen quite a few examples of people trying to make money out of it, some are pretty outrageous, but it comes with the territory.

For my client base I have looked critically at the website and email side of things and there are some things that are worth doing to firm up on security. This is my list, if you want me to work through this list (I mention why in most of the items below) it is a one off charge of £50. In some cases I have already actioned some of these things below on some sites such as turning on SSL for most people and setting up offsite backups. This past two months, more and more of my time is being taken up doing things for free. Unfortunately, I still have expenses to cover, so I cannot do everything for free.

Am I covered for GDPR if I do all of these things?

The short answer is no. The actions listed below cover and protect one part of the information gathering systems. But GDPR is more about what you do internally in your office, how you deal with the data and protect it. You still need to do that work. It starts with a Data Protection Impact Assessment (link to ICO website). Please make sure you have read and understood what GDPR is all about. Your website and email systems are a small part of it. Continue reading More on GDPR and your hosting

What you don’t know can’t kill you

For many charities they may independently buy hosting and build a website, or someone else builds it for them and they don’t take any more action. There is a flaw in this, not all website hosting works as smoothly as you may think it does, and as you will see in this article, sometimes things happen which will substantially break a site, ….. and you are unaware of it.

Over the past two weeks I have raised around 10 support cases with the hosting provider we are using. They have been brilliant over the past year, I don’t have any regrets moving to them, the sites are generally trouble free. Since we moved to them last year, I have raised 178 support cases on your behalf, you never knew that did you? Continue reading What you don’t know can’t kill you

Changes to incorporate SSL

With GDPR coming along shortly, I am working my way around the hosting accounts and where it is possible, I am enabling a security certificate for each domain.

Unlike the previous hosting we were in, this one offers free security certificates, they normally cost around £75 per year. They are free to me, so they are free to you.

What does this mean?

It means that when a visitor comes to your website they do not go to http:// they go to https:// the “s” is important because it means the data going to and from the website is generally* encrypted. I will explain why I have said “generally” in a moment”. SSL means Secure Socket Layer.

What is particularly important is anything entered into a form is encrypted between the user and the website, and therefore nobody can intercept it on the wire. When your site was first built we were not able to use SSL certificates, and all requests and data entered between a client and the server were in plain text. If they could be intercepted then they could be read. Continue reading Changes to incorporate SSL

GDPR Resources

The following is a list of sites referring to GDPR

Some of these may be touting for business. If they are, that is not why they were chosen to be included in this list. You may find some useful guidance here that relates to your organisation and what you need to do.

I am aware that some of the parent organisations of the charities I support are running training on GDPR and as such you are probably adequately covered for your operations. Others though have no centralised guidance, so are being left to their own devices. Hopefully these links will help, along with other things I have published on this site.

Information Commissioner Site

Start here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

Probably answers most questions and is a comprehensive plain language guide.

General Resources

Commercial site offering guidance

https://www.itgovernance.co.uk/data-protection-dpa-and-eu-data-protection-regulation

What is personal information?

eugdprcompliant.com

Is an IP address Personal Information?

https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases

GDPR Privacy Notice

GDPR (General Data Protection Regulation) is due to come into force from the 25th of May. Everyone processing data in any form will be subject to the requirements of this new regulation.

I have been researching the implications of the regulation with regards to your website, and have attempted to put an example notice together which will help to cover the regulation. First though some caveats. Continue reading GDPR Privacy Notice

Emerging GDPR

Chances are this affects your organisation

GDPR stands for General Data Protection Regulation, which will become law in May of this year. It tightens up on existing Data Protectionregulations. It does have implications for everyone on the web, but it also extends to your back office systems (so beyond your website and email systems and our relationship) where you have recorded in any form; personal information.

Right now I have not read it all. I will return with some recommendations or things to think about in late Feb or early March. In terms of your websites, there may be things you need to do. For any CRM (Customer Relationship Management System) or any database or method for recording personal information, you will be affected. So do not ignore it.

Information Commisioner Office

You can start by going to this link and reading the material there: ICO GDPR.

Online learning course

A colleague has also pointed out that there is a self guided course available for free which takes around 3hrs. I have not looked at this yet, but do check it out. Go to Future Learn. I have not validated either of these yet. Do not pay anyone any money just in case there is a solicitation for money (unless you wish to). Guidance on the regulations should be available from multiple sources for free. I suspect that there will be a lot of FUD as well (Fear Uncertainty and Doubt) peddled by some consultants seeking to help you for a fee. So do take care. Continue reading Emerging GDPR

Account Pending Cancellation FINAL NOTICE

Or is it?

I received the following email entitled Final Reminder houseofprayerforallnations.org Expiration SEO. Within the email when you open it is this message which all looks official.

Continue reading Account Pending Cancellation FINAL NOTICE

Fast Secure Contact Form

Some of the websites I have built use a plugin called Fast Secure Contact Form. It was a very popular form handler highly regarded by users written by Mike Challis. The plugin was sold to a third party in June of this year and the new owner attempted to manipulate the code in the plugin to set up adverts.

Please check ASAP whether the version that is currently in use on your website is version 4.0.56. You can do that by logging in, and going to the Plugins page and look down the list. You will see an entry similar to the one below which includes the version number.

If you have version 4.0.56 you are OK! Don’t panic.

If your site is at an earlier version contact me immediately and I will sort out updating it.

(update: 6:00am 27/9/17 Nobody has reported a problem so far, all sites have upgraded automatically. That was to be expected. If you cannot find Fast Secure Contact form another method is used for forms on your website. Probably Form Manager. You are not affected by this notice.)

Why is this important?

Continue reading Fast Secure Contact Form

Is my internet slow?

Or… the Onion of Discontent

There are many reasons why an internet connection may be slow, some of them will be directly under your control, and others will be under the control of the equipment manufacturers of the devices used that the communications pass through. The extent of which is from the device you are using to the server at the far end of the connection. Various services providers share the responsibility of carrying the traffic. It is a complex picture to reconcile.

Where is the problem?

When trying to establish where a problem exists the first person you call is your service provider (BT, Talk Talk, Virgin etc). They will follow a fixed trouble shooting process which will try to prove that the problem is something you are doing, or have done or is within that part of the network you control. They adopt this approach because if nothing is listed as a fault in your area, then statistically it is most likely to be something at your end.

That will include your router/ hub, your phone wiring, the building materials used in your house, the location of WiFi access points, the list is large. They will not be as direct as that, however those are the implications. Continue reading Is my internet slow?

Phishing Page

What is it?

We have all read about phishing trojans, but many of you probably do not know what they are or how they work. I came across one over the weekend while backing up a client’s website. My anti virus system prevented me from downloading the backup to my computer and warned me that one was present. As I was concerned about the security of this particular website I took it apart to find out where it was, and what it was doing.

Phishing

Phishing refers to a form of identity theft, it is where credentials like a user name and password are compromised, often without your knowledge. Other than reading about them, I had not come across one before. This one relates to stealing the credentials to access someones email address and email password.

I turned off my anti-virus (not recommended if you do not know the risks) and downloaded the zipped folder containing the files into a special area on my computer and then inspected the files. Two files contained code, one was a web page. Only one of the files was being flagged as the one containing the Phishing Trojan, the file contents were very simple, they packaged up the information and sent out an email to two recipients. Continue reading Phishing Page