If I dare bring up the subject of “passwords” to a customer I typically get an immediate response of an uncomfortable groan or moan. With the proliferation of social media sites, web service accounts, and other logins, managing passwords has become ever more daunting.

But, as painful as they are, good password policies are the cornerstone of any  sound security program. And, if you have an Ecommerce site and are serious about PCI Compliance, you want to formulate a password policy for your business and stick by it.

Here is a simple idea to help you with creating good passwords. You can think of it as a word game of sorts.

1. Start with a group of names that mean something to you. Perhaps the characters from Star Wars. Or maybe, your past spouses (okay, that one will only work if you have had a checkered marital past!).

2. Then layer on top a group of numbers that are already etched into your mind. Perhaps it could be the birthdates of your kids. Or it could be the uniform numbers of your five favorite basketball players.

3. And then think of a substitution you can use. For example, you will replace instances of the letter A with an Ampersand.

Using this methodology, I have come up with the following password: Y69d12n03&

What is that pattern, you ask? It is my brother’s name, Andy, spelled backwards, with his birthdate interspersed between the letters. For good measure, I swapped out the A with an Ampersand and led things off with an uppercase Y.

Compare this password to something like “Andy1234″ which would immediately flunk any password test. Why? Because a password with recognizable words, names, and number sequences is an easy target for a password cracking program. My more complex pattern only make sense to me.

If I used my password formula in conjunction with my other siblings’ names and meaningful dates, I could have a set of passwords that would be relatively easy for me to remember, but difficult to get hacked. The key is if I remember my formula, I can come up with a complex combination of characters without actually having to memorize a bunch of gibberish. The goal is meaningful gibberish.

Passwords and security are a dead-serious topic. But by having a little fun with your password selection you will help yourself in creating strong passwords that will serve your business well.

We are proud to announce the launch of customized product feeds for websites running the MightyMerchant platform! What does this mean, you might ask?

Simply put, product feeds are a way to send your website product data to countless other websites and comparison shopping engines, including the big ones like Google, Amazon, and Yahoo. They give you the opportunity to get your products in front of many more shoppers and drive them to your site for purchasing.

One popular service is Google Base (Formerly called Froogle), a free service which allows you to submit items to Google, which then come up in searches in Google Product Search. Sometimes, these products will even come up in a standard search. As an example, try searching for “simax heavy wall tubing” in Google, and you will likely see Shopping Results near the top of the page showing specific products available on one particular MightyMerchant site, glass supply distributor Winship Designs. Talk about great exposure!

Although MightyMerchant has offered Google Base feeds for years, we are now offering managed feed services to ensure your products are optimized for maximum exposure, as well as target a much broader range of comparison shopping engines. There are many other services online that allow you to submit a product feed to increase your product’s visibility. Some of these include:

• Yahoo Shopping
• Nextag.com
• Shopzilla.com
• www.become.com
• Shopping.com
• Pricegrabber.com

…and many more! Chances are if you find a site that accepts a feed, we can build a custom feed in the required format and get your products an online presence far beyond your site.

If you would like more details about this exciting feature, or feel like this is something your site must have, then Contact Us and we’d be happy to discuss how custom product feeds could help your business.

Google has a new competitor. Search engine Cuil, pronounced “cool” (the word ‘cuil’ is a Gaelic word meaning knowledge), officially launched today. And while Google can definitely use some competition, I don’t expect Cuil (www.cuil.com) to revolutionize the search experience.

One thing it has going for it is that Cuil was started by former Googlers, who presumably learned a thing or two while with the search behemoth. But it has some immediate differences. For one thing, Cuil can’t use PageRank to organize the results, as Google obviously has that technology squarely in their clutches and they’re not letting go. So Cuil has to look for different criteria with which to assess the relevance of a page. Cuil actually looks at the content of a page, and ignores the popularity measures that Google considers most relevant, such as link analysis.

First, Cuil finds pages with the keywords you searched for, then analyzes that page’s further content and “its concepts, their inter-relationships and the page’s coherency.” The results are returned not in a list but in a 2- or 3- column format, which is visually a more interesting way to view.

Another nice thing is that Cuil’s home page is black, with no ads or other distracting clutter, and there are no sponsored results at this time, so the user experience is bound to be a little cleaner.

Cuil also offers suggestions for refining results. Cuil claims to have a searchable database that’s 3 times the size of Google’s, but really that doesn’t matter much. The size of the index isn’t the most important thing to a user; if the engine doesn’t return the results the user is expecting, they just won’t use it again, and it won’t matter how many pages Cuil has to pull from.

Another thing that makes Cuil a little bit cooler than other search engines is that they promise not to collect or save user data, so your search history is always private, unlike the big Google.

Still, there’s something missing. I searched for “blackberry,” thinking that would be a good search term to test because of the different meanings of the word. All of the results were about the hand-held device, but to the right of the page was an “explore by category” button with the option “Hybrid rubus,” in case you were wanting info about the fruit. Under that category was three options: boysenberry, loganberry, and olallieberry, all of which are varieties of blackberries. However, clicking on those subcategories revealed that Cuil didn’t have any information about them. Cuil suggested that I entered a typo, that my search term was rare, or that I had entered too many search terms. If Cuil is going to come anywhere near to being the Google-killer they claim to be, they’re going to have to beef up their relevancy algorithm, and quick.

People often ask why they should invest in a hosted web application. Paying a monthly fee for someone else’s software doesn’t sound like a very good deal at first. I recently joined MightyMerchant’s team, and I can tell you from personal experience, hosted web solutions are a very good deal! I wasted thousands of dollars and hours trying to get an expensive desktop application to do the job I wanted before finally giving up. A little research led me to web-hosted applications, and I quickly realized the benefits of having a professional team of programmers and developers at my disposal. Web-hosted solutions absolutely make the most sense for business owners who want a profitable web presence.

There are a few people who seem to have an innate knowledge of the mechanics behind those glossy webpages we love to surf. They don’t mind spending the extraordinary amount of time and effort it takes to get professional results. Those are the people who’ll tell you you’re better off buying the software. Without their training and experience, you’re treating your business like a DIY project. I’m going to give you the same advice you’ve heard from friends the world over. “Save yourself the headache and hire a professional!” Personally, I’d rather enter a few dozen lines of copy, download an image or two, and go to lunch. I’m happy to let the professionals do the work for me. At the end of the day, I’ll total the sales and smile. Teh nice.

I shared my experience comparing hosted web solutions and desktop applications in detail on the MightyMerchant website.

Paige Pryor joined MightyMerchant in June as the new Account and Project Manager and self-appointed Environmental Coordinator. Her background and experience in marketing, sales, and database administration led her to web-hosted solutions as a convenient and cost-efficient method of relaying products and services to customers.

Your ecommerce website is live. You’ve got a marketing plan to draw people in to your site and the quality content and usability experience to keep them happy and coming back to you. You’re ready for customers and eager to see your business thrive. The last thing you want to do is turn down an order, right?

Actually, when your ecommerce site is new, a cautious approach to filling orders and shipping is a good idea. For new ecommerce sites considering whether or not to ship internationally, there are a few things to keep in mind which could cause you to avoid shipping internationally or at least delay it until you have more experience and your site is more established.

The two major issues involved in the decision of whether to sell your products internationally are order/credit card fraud, and shipping costs. If your business is based in the United States and you decide to sell internationally, it is likely only a matter of time before you are faced with a fraudulent order. That’s not to say that fraudulent orders don’t originate in the United States, because of course they do, but there are a few reasons why overseas orders are particularly problematic.

Price

One of our new sites, LearningServicesUS.com, sells educational software for teachers. As the site owners were preparing to get their site ready to go live, they were investigating international shipping options and discovered that the shipping to Brazil for one item would be over a thousand dollars! Probably not realistic to consider shipping at that rate. After discussing the options with LearningServicesUS, the verdict was that after they build up clients and sales that they would revisit the international shipping issues and reconsider later. In general, we wouldn’t advise new ecommerce sites to offer international sales, partly for this reason of exorbitant costs, and also because order fraud is much more rampant overseas.

Lack of enforcement

Many developing and Third-World countries don’t and can’t allocate the resources necessary to properly monitor fraud, track fraudulent activity online, and pursue and prosecute thieves. There’s just no money for these tasks. Additionally, the market for stolen credit-card numbers is most active outside of the United States. If you do offer overseas shipping, you may want to consider avoiding orders from certain high-risk countries where fraud is known to be a major problem. Countries such as Romania, Latvia, Belarus and other Eastern European countries have high fraud risks, as does Nigeria, Sudan, and Ghana, countries in southern Asia (Phillipines, Thailand, Malaysia) and Middle Eastern countries (Iran, Iraq, Libya). *

What you can do to avoid fraud

It’s wise to have some internal checks in place on your ordering system. These suggestions for protecting yourself from fraudulent orders hold true even for domestic orders, but are especially important if you do decided to offer international shipping.

Avoid shipping to post office boxes. United States Postal Service (USPS) shipping rates are more affordable for overseas shipping when compared to UPS or FedEx, for instance, but USPS can’t track overseas packages and postal service in the destination country may be unreliable.

Compare the credit card billing address to the shipping address. For an overseas order, insist that they match.

Hand review each order over a certain amount. Pick an amount that makes sense for your business and manually review all orders over that amount. If you normally get orders averaging only$100, a $250 order may ring some alarm bells. Consider calling all customers who place orders above this set amount to personally verify their orders. Depending on your product and sales volume, maybe a $500 order would seem suspicious. Just keep in the back of your mind that a “too good to be true” expensive order really may be too good to be true.

Do a BIN look-up. The Bank Identification Number, or BIN, is the first six digits of a credit card. These numbers identify the bank that issued the credit card. The free service at http://all-nettools.com/toolbox, financial allows you to enter the BIN numbers to determine the issuing bank. It’s worth investigating if the issuing bank is located in a country other than where the order is originating.

*source: Scribd

I recently put out a call asking for people to share their best business resources. Could be anything…a newsletter, website or blog you turn to for marketing inspiration or a time-saving tool you use everyday. I plan to turn those responses into a series of posts on this blog-with a link to the respondents’ websites and a little about the business if you like-about what real businesses feel are their best resources. If you would like to share your most helpful resources with me and our readers, please email me or leave a comment here and I will respond. This is the first post on this topic.

One of the first responses I received was about a topic on the minds of every small business that sells online-order fraud. Unfortunately, this is a widespread problem and one that is likely to burn every ecommerce webmaster sooner or later. I broached the subject of identifying and preventing order fraud in a previous post, but here is the experience of one of our clients who wished to remain anonymous, and the tools they use to combat the problem of fraudulent orders.

“Identity theft is a real concern for us. Early in 07 we learned the hard way how to avoid being victims after we shipped three orders worth about $800. Two out of the three were delivered, we had UPS do an intercept of the third package worth about $300. As you know there is a flag system for detecting if a transaction may be suspicious. One of the most helpful resources is the white pages for reverse phone number look up. Out of the services we have tried their listings seem to be the most complete, even if it is a cell number, the city and state is listed.

“Another resource is used for IP look up that shows the customer’s general location. [Vanessa's note-this is a free service.] Our credit card processing company, Authorize.net, lists our customer’s IP number on each transaction, from there we can plug that into the IP look up and see the location of our customer. Location is everything! Once I detected a fraudulent transaction…the customer’s “bill to” address was Michigan, the “ship to” was Miami. By looking up the IP location I found that the person placing the order was in fact in Columbia.”

It’s likely you aren’t checking every single order that comes through your shop, but when you do get that feeling that something’s not right or perhaps you conduct a random check, these tools can help you avoid being a victim. What do you do to help decrease the incidence of online order fraud?

It’s mid-November already, and online merchants are gearing up for what promises to be the biggest online shopping season ever. As increasing numbers of people shop online, merchants must be ever-more vigilant about preventing and detecting order fraud. Fraudsters are sophisticated, and the number of fraudulent orders rises every year. Going over-limit on credit card chargebacks and refunds can destroy a merchant’s ability to accept credit cards, which can be the death of an otherwise honest business. Fraud costs you not only money but time, so it pays to protect yourself. You probably can’t eliminate all fraud, but these steps can put a dent in it.

The first line of defense is identifying suspicious orders before you fill them:

• the order contains multiple requests for the same high-ticket item or is for many of the same item that is easy to resell
• foreign shipping address but U.S. billing address
• the IP address doesn’t match the billing address
• ZIP code and address don’t match (an AVS, Address Verification System, can determine this)
• the order is much larger than your typical order
• the order is missing information

If just one of these problems is present, there may be no concern, but if more than one of these red flags present, take some additional action. For instance, a large order for many of the same expensive items, from a foreign address, with overnight shipping would be a big red flag.

What you can do:

If you have the full credit card number, call the bank and verify that the card number matches the billing address. If you have a phone number for the order, call it just to make sure it isn’t a disconnected number. Assuming you did reach an actual person, a fraudster is not going to admit to being a fraudster! However, you can call suspicious orders and verify details by phone. Ask the customer if they really intended to buy 100 Swarovski crystal-encrusted napkin rings or whatever it is. Most legitimate customers will be thrilled you’re taking the extra step as a security measure. This protects them from unauthorized charges as well as yourself.

You can Google the name, address, or phone number that you received with the order and see what you can find out. Keep in mind that people move, and online records may be out of date. Call the credit card company and verify that the billing address, name on card, and CVV number are correct.

If none of these steps reassures you that the order is legitimate, you may simply cancel it. If you can, send the customer an email saying that you were unable to verify their credit card. Legitimate customers will almost always follow through to see what the problem is while a scammer won’t.

If you aren’t currently using an Address Verification Service (AVS) and Card Code Verification (CVV/CVC2/CID), begin using it. These tools detect irregularities in a cardholder’s information that can give you a heads up that this order needs more attention.

Scammers know the clock is ticking on stolen credit cards, so they request overnight or express shipping. Coupled with an extremely large order, incomplete order information, or some other issue, call the phone number to say that there is a delay in processing the order. You might be able to tell from their response whether or not the order is legitimate.

Call large orders and tell them that you require signature upon delivery. If they refuse, consider voiding the order.

MightyMerchant’s article, “Fraud Prevention-Just The Facts,” has many more tips on how to identify suspicious orders and outlines steps to take if you receive an order that you believe is suspicious. Arm yourself with the tools to identify suspicious orders now, and keep fraud to a minimum on your site as the holiday shopping season enters full swing.

My husband works in a supervisory capacity in a manufacturing shop. Most of their day-to-day production tracking requires spreadsheets and other computerized reporting tools. He was never issued a password and neither was his boss, so for years both used the passwords of other employees. It didn’t take long before both men realized that the passwords for almost every machine operator, engineer and office worker in the whole shop had passwords that were simply their first names.

My husband is not malicious, but if he had been, he could have logged in anywhere using almost anyone’s password, and changed, deleted or otherwise mangled any report he wanted to. His shop has since changed their reporting procedures, and now require universal access. This situation seems worse: All the shop workers have one access code, while all the supervisors have another, and they are so simple and obvious it would take no effort to guess what they were.

You’ve likely spent years building your business, and secure access is at the frontline of your defenses against hackers or begrudged employees who might want to be destructive. Choosing effective passwords takes a little creativity. It does make them a bit harder to remember, but if creating a unique password helps stop someone from breaking into your accounts, you’ll be ever so glad you made the effort.

• When creating a good password, don’t use words that can be found in a dictionary. Password-guessing programs can simply run through common letter combinations automatically.
• Make each password unique. Hackers know people re-use passwords, so if someone is able to guess a low-level password, they will use it to try to gain access elsewhere. Don’t use your Facebook password for your online banking and PayPal accounts.
• Longer is better. Use at least eight characters.
• Avoid keyboard patterns (qwerty) or sequential numbers (4567), and don’t repeat (1122).
• Strengthen passwords by mixing capital and lowercase letters, using numbers and punctuation marks, and using substitutions, like the number zero for the letter ‘O’.
• Acronyms are good, but don’t use anything obvious like the initials of your name. Create one from something you personally enjoy, for instance, “i love home made cinnamon rolls!” would become “ilhmcr!“. (That is simply an example. I don’t really love home made cinnamon rolls that much.)
• Avoid obvious things like your birthday, phone number, or pet’s name.
• Fun ways to make passwords easier to remember: Pick a phrase and eliminate the vowels, such as “sit on the porch” would become “stnthprch.” Combine words, such as “tooth pick” morphing into “tpoioctkh“. Pick a word, then use the letter to the left of each letter in the alphabet: “shiver” = “rghudq”

Once passwords are created, keep ‘em safe.

• Never tell another employee your password. If you must share occasionally, reset your password later.
• Never write down your password, sticky-note it on your computer, or slip it in your desk drawer.
• Log off when your computer is not in use, or lock your computer at night.

Many companies offer password storage, so if you don’t have a mind of steel and the number of passwords you are using gets to be overwhelming, this could be a good option. I’m almost at that point myself!

My local paper reported on Internet security threats today, describing the creative new ways hackers are spreading malicious code. The article, “Hackers find new ways to spread spam, viruses,” describes the threat of malicious code embedded in online video players, according to a report released today by the Georgia Tech Information Security Center as it holds its annual summit this week.

The summit gathers more than 800 scholars and security experts as they discuss emerging threats and their possible countermeasures. Naturally, as we see an evolution toward more sophisticated anti-spam techniques, spammers attack with evermore sneaky techniques of their own to deliver malicious messages. Among some of the clever ways hackers hide their codes are embedding them in images or disguising them as PDF files.

The article says there have been “a few” cases of video-related hacking so far, including a worm that launches a corrupt website after a user opens a media file in a player, and another that silently installs spyware when a video file is opened. Spreading fake video links that contain worms and viruses have been attempted using YouTube.

The article goes on to say that hackers are exploiting social networking sites, which by their very nature rely on “viral” spread via users who want to share information.

Unfortunately, the article doesn’t provide any advice on protecting yourself, but we outlined some safe-surfing tips in a previous MightyMerchant blog post. Another good anti-spam resource is The Spamhaus Project.

Tags: youtube, virus, malware

What is Malware

Malware is a serious issue, so much so that Google recently started a blog devoted to malware and other security issues (see June 2007 SiteBeat here for information about the Google Online Security Blog). Sites on unsecure servers are most at risk, and MightyMerchant’s servers are very secure, but safe surfing and downloading practices can keep the malware problem in check.

The word “malware” is a shortened form of “malicious software” and is a general term meaning software or program code designed to infiltrate or damage a computer system without the owner’s consent. A computer virus is one type of malware, which can also include worms, trojan horses, spyware, adware, or any other type of software with a malicious intent. Profit is the greatest motive behind malware, much of it is designed to take remote control of the affected computer and use it for some nefarious purpose.

Spyware is a new form of malware that is intended to monitor users’ web browsing. It uses this information to display unsolicited advertisements or redirect unwitting users to the site of the spyware creator. These are not the same as viruses in that they do not spread from computer to computer, but are installed by the program being able to exploit weaknesses in the computer’s security. Spyware is often bundled as third-party software with free software that is knowingly downloaded. Malware can copy a user’s keystrokes to steal passwords or credit card information, which is then transferred to the malware creator.

How to Prevent Malware

Most malware can be prevented by using a virus scanner any time you download something. Also, use care when opening email attachments that have executable files in them if you are not absolutely sure the source is trustworthy. Ad Aware (http://www.lavasoftusa.com) is a detection program specifically for spyware. Your operating system is one factor. Microsoft platforms are more vulnerable to malware than is Macintosh.

Keep your computer’s software up to date. Download any patches only from the legitimate websites of the company. Only download from reputable sources, and use caution: LimeWire, a popular file sharing program, recently informed its users that trojan viruses were installed on computers after users downloaded files that LimeWire claimed were updates.

If You’re Affected

If you find that your site is affected by malware, either because you’ve lost control of your computer, you are inundated with pop-up ads, or you have lost data, GoogleWebmaster Tools now has a malware review form. Google refers those concerned about malware to this website, http://www.stopbadware.org/home/security, which has a lot of helpful information about preventing, spotting and removing malware. In the case of malware, prevention is a whole lot easier than cure.