Program Data

Information and data security on all corporate websites, in particular against content scrapers and cybercriminals.

Overseeing and supporting the implementation of the Security Management Program and Processes for Website’s Data to ensure that marketing and digital communication assets and the 5 (five) website data are adequately protected. Proactively identifying, evaluating and acting on data security risks. Additionally, working with cybersecurity specialists, and a variety of IT-related risk and data security activities to adopt and improve ‘best practices‘ offering the best ROI and operational benefits.

Project initial deployment: 2020.

The number of websites: 5 (five) corporate-wide complex websites, with approx. 2’000 daily visitors.

Context

Every day, businesses are creating products and services that have a positive impact on millions of people. However, for some independent consultants and small businesses, cybercrime and content scrapers have a very negative impact. In a majority of situations, achieving medium-term strategic objectives is retarded by parasitism, criminal, and unethical activities. That is why technical and business protection solutions are becoming more and more important to protect their digital assets.

Today, the website is becoming a central hub. A business is presenting its products, services, price estimations, and other multi-media assets such as videos, podcasts, articles, papers, case studies, eBooks, and even selling via its eCommerce part. All those data, as well as marketing support data, become the target of thieves and content scrapers. Content creation comes with a cost, and this cost is highly increasing due to the competition. Besides, compared with the size of the company, those costs are proportionally higher for a small and medium-sized business structure.

The major challenge is to keep an equilibrium between the major aspects:

• the loss of performance for the end-user
• the initial and operational costs and the ROI
• the facility of implementation, usage, and maintenance

Solution

The technical and business operations barriers will not stop cybercrime or illegal actions against your website data and content. However, the custom implementation of those solutions may reduce the negative impact of cybercriminals. Keep in mind that if your content is ‘good enough’ to be stolen, then it is worth protecting it.

The solution is split up into the:

• protection and reactivity against the technical hacking
• protection and recovery of the system hacking
• protection, reactivity, and recovery on the functional business hacking

Positive aspects of the program implementation:

• increased by a median of 22% the speed of the website for targeted visitors
• while reducing by a median of 67% the stress load on the server
• with a 60% minimal reduction on bandwidth costs
• and eliminating an average of +11’000 per month of complex hacking attacks and illegal unauthorized access
• and also significantly reducing content theft by bots or humans. In the absence of measured data and previous reports about content theft, the estimation of this content theft reduction is 50%.

Negative aspects of the data protection implementation:

• initial loading time & security checks increased by a maximum of 4.7 seconds, with a minimum of 1.4 seconds, and a median value of around 2 seconds
• high-volume data for fast-turnaround web-traffic analysis
• high costs of the solution implementation and third-party vendors

Project Implementation

First, the implementation consists of analysing website data needing protection, and their importance for the business. This business data might be under the form of many ‘green content‘ articles, papers, case studies, infographics, videos, or any other multi-media digital assets, as well as the customers’ and leads’ data. Engaging the content creators and providing security best practice knowledge at the Advanced and Senior Levels for all intellectual property, projects, and data is also part of this first step.

In a second step, defining which solutions can be realistically implemented across various environments, including the migration to a more reliable and cost-effective Swiss-based modern data centre. The vendors’ selection, coordination and tracking of technical projects implementation by third parties are a couple of activities associated with the general strategy related to the Security Management Program and Processes for Website’s Data. An on-site, and operational contribution to the development of the policy and control framework, specifically to potential risks and protection is implemented at this stage.

Finally, active surveillance of logs and security incidents is part of the operational improvement. Elena Debbaut’s practical experience in software development, and a good understanding of scripting and web development allowed a faster ramp-up, bug correction, and some solution replacement. A strong +25 years of professional experience support areas such:

• user identity and access management, including privileged access management
• hands-on check and firewall configuration to block unsuitable visitors and attacks
• useful data classification for faster ROI data protection with a strong focus on the ‘Data Loss Prevention‘ that is very costly for a small to medium-sized structure
• automation of repetitive tasks such as blocking with scripting, server-side solutions, and precise workflows
• identifying existing threat models (credentials, URL links, data of interest), and patterns based on limited data

Long-term viability and costs

The ramp-up costs of technical and business solutions against content scrapers and cybercriminals are as high as the website’s initial creation. The costs of multi-media web and digital assets are often superior to those website creation costs and become part of the business’s intellectual property. Cybercrime is everywhere, so the implementation of Website Data Protection projects and processes is worth it.

For a mid-market website, initial implementation costs on this project-type can be at a minimum of 60’000.- CHF, including various third-party solutions, web applications, cloud web services, databases, and other implementations. There is a regular cost of a minimum of 20’000.- CHF per year for web operations security. Costs of incidents and recovery are extra.

Security Management — Program and Processes