It’s Only A Matter of Time Until You Need to Be Licensed to Operate A Web Server

PALM BEACH, FL – I have been thinking about this off and on for a few years now, but I have never really posted or written about it. That is because it is an awful prediction that I hate the idea of, but I think it is going to eventually happen. Here it goes….

I predict that to operate a web server sometime in the near future, you will be required to have a license, or have passed a basic course in IT security or Cybersecurity intrusion mitigation. Not at the single site consumer level, but at the dedicated or semi-dedicated level.

Yea, it sort-of sucks, but I think its going to happen eventually. Believe me, the last thing I want is more bureaucratic hoops to jump through, in order to do my job, but I believe it is going to be necessary for consumer safety.

Big companies like GoDaddy, HostGator, Rackspace, will themselves be licensed and will be able to assign customers a single web hosting account for a single domain without issue, but a customer who is able to sub-lease space and then assign that space to various different domains or customers without any oversight whatever, those persons will need to be licensed, registered or have passed exams, with some sort of governing body that has provided them the permission as well as assigned a level of responsibility for those sub-leased accounts, so that when that authorized party does so, irresponsibly, that license or permission can be stripped or revoked. Such a move will create more accountability for all web space.

Hacking, phishing, and virtual theft is just about everywhere nowadays.

Just moments ago, I was alerted by WordPress Security service WordFence.com, that 28,000 GoDaddy hosting accounts were compromised – last year – via an SSH vulnerability. We are finally finding out about it now, that those 28,000 accounts were vulnerable to intrusion.

SSH (Secure Shell) is a server connection method which can give an attacker full control of a web hosting account to pretty much do as they wish, and is often used, when maliciously, to either A) take over a web server and put up a fake misleading website, or B) to gain control of the mail server and send spam (usually to send people to a fake site).

To hackers, a fresh previously uncompromised machine, or even single website hosting account is extremely valuable because it can be used to fool people while hiding the perpetrator as well as by-pass spam filters as the IP address assigned to the hosting account is likely clean and can be used until it is banned, especially if the machine has multiple IP addresses assigned to different sites and can be reconfigured to send spam from different IPs. Clean sites also show up in search engines and can harvest search traffic to redirect users to nefarious places.

I remember years ago, probably about 12 years ago, before the frequency of hacking we see today, I was hacked and taken advantage of, but quickly caught on to the scam and shut it down. I was, at the time, using HostGator, and someone had compromised a single site on my server and created a sub-folder section of the site (which I had no idea existed) and put up a fake bank site. They then compromised someone else’s server and used their server to abuse their mail system, sending users to the fake bank site on my hosting account attempting to get them to login and capture their username and password.

I was tipped off by the hosting company that suspicious traffic was hitting one of my sites and that the hosting account would be shut down if I did not mitigate the situation. I immediately reviewed the fake site, and disabled access to it, but I wanted to see what it was that these scammers were trying to accomplish, so I downloaded all of the HTML code and when reviewing the sites code, I was able to ascertain that the login form on the homepage of the fake bank site, was designed only to refresh the screen and send users to the real bank site, which was The Bank of India, and immediately send the users login credentials to the scammer via a very simple PHP email form (consumers would just assume they mistyped the credentials and try again). What a clever scam, and I felt violated as being a part of it.

At the end of the day, who was accountable for my vulnerability?

No one.

That experience taught me that part of my job for each and every hosting account I manage is security mitigation and hacking prevention, because ultimately I am responsible for my web space and I don’t want to have to migrate all over the place for violating ‘acceptable use policies’ or ‘terms of service’ agreements through irresponsibility.

But if I do, what stops me from just moving to a different server provider?

Nothing.

There needs to be more accountability for those who provide web space to third parties.

Again, if an irresponsible web server operator gets shut down at one hosting company, what prevents them from just moving on to a different hosting company and doing the same thing, even if just carelessly at fault?

Nothing at all.

We have already seen merchant account owner requirements when it comes to PCI compliance (Payment Card Industry Data Security Standard), something all merchant account holders are responsible for. In the State of New York, and likely other states, they have begun to place some sort of accountability through the Division of Financial Service (DFS) with their “Certification of Compliance pursuant to 23 NYCRR 500” or “Cybersecurity Regulation”. This new regulation requires companies who have been licensed in financial services areas to have a dedicated responsible party or “Chief Information Security Officer” which addresses data vulnerabilities and risks. These officers are also responsible for third parties or ‘affiliates’ they share information with. If and when there are issues companies risk loosing their license.

But what risk is there for the provider of web-space?

Nothing.

It is just not rational for today’s growing importance of the Internet, as well as today’s growing need of privacy and security to have “Nothing” in place, to hold accountable the provider of the venue used for compromise, so do not expect the Wild West to last, especially the cheap virtual server accounts to anyone with $20 and a credit card that works.

John Colascione

About The Author: John Colascione is Chief Executive Officer of Internet Marketing Services Inc. He specializes in Website Monetization, is a Google AdWords Certified Professional, authored a ‘how to’ book called ”Mastering Your Website‘, and is a key player in several Internet related businesses through his search engine strategy brand Searchen Networks®