Google claims that 9,500 websites per day are infected with malware meant to harm the site’s visitors.

To deliver their malicious software to as many victims as possible, cyber-criminals have turned to websites as one of their primary sources of distribution.

1.  Cyber-criminals have learned how to use malware to turn large profits by: displaying and clicking ads; stealing confidential data; hijacking user sessions; compromising user login credentials; stealing financial information;

making fraudulent purchases, creating spam; and launching denial-of-service attacks.

2.  They exploit a vulnerability on the web server or in its configuration.  They exploit a vulnerability in the applications the website relies on.

3. Website applications like Joomla!, Drupal, MediaWiki, Magento, Zen Cart, and many others have all had vulnerabilities in them that allow malicious hackers to upload malware to these sites to be distributed to visitors.  Websites built in Joomla and some WordPress can be hacked easily.

4.  For attackers to exploit a web application, they must find some type of vulnerability.

5.  When Google and the other search engines find a site that is serving malware, they can pull it from their results. This can have devastating effects on a business.

6.  The responsibility for protecting websites against attack is falling on the shoulders of the web developer.  Now, the developer needs to make sure that his or her code is functional and secure.  If your website gets hacked or infected, your web developer needs to test for and remove vulnerabilities or re-build your site in a more secure application…and learn about website security.

7.  Unfortunately, it is the small business website, the church website, or even the well-respected news website that is responsible for infecting so many computers.

8.  Banner ads should not be clicked.  They trick users into downloading malicious code.  Downloads from websites can also contain malware.  Drive-by-downloads occur when the visitor does not need to perform any action on a website other than simply visit.  Malware is hidden inside invisible elements on the site.  When the page loads, the malware infects the visitor’s computer using vulnerabilities in the browser or plug-in.

9.  The threat landscape changes daily. As zero-day exploits emerge and cyber-criminals adapt to countermeasures, web developers need to adapt and be on the lookout for how they can better secure their sites.  Website design is no longer a straightforward process and many website designers understand very little about technology and security.

10.  If your website is hacked or infected call your web developer immediately.  Do not let them reload a copy of your website unless they have determined that it is clear of vulnerabilities- otherwise you will be infected and/or hacked again!