![[Shopify] E-commerce site security: Platform types の
アイキャッチ](http://en.cavedescript.com/cdn/shop/articles/security-type_6f676ee1-6f81-4c66-a4aa-5f73f0336fb9.png?v=1737427399&width=800)
[Shopify] E-commerce site security: Platform types
When creating an e-commerce site, the type of "platform" is a very important factor when considering security!
There are three main types
- In-house server type
- ASP type
- Molding type
Think of it as referring to these three things:
In this article, we will explain the security measures that need to be taken for these three types .
This is the most general blog about security and where you need to protect, so if you haven’t read it yet, I highly recommend you do so.
table of contents
Security by Type
As mentioned in the overview blog, security measures when creating an EC site can be roughly divided into "the main body" and "third-party apps".
(See separate blog for more on third parties)
We would also like to inform you that there are differences in the console itself depending on the platform.
And of the three types I mentioned at the beginning, to be honest, the one that concerns me the most in terms of platform differences is the "in-house server type."
So I will start by explaining the in-house server type.
In-house server type
Although it is called an in-house server type, in most cases a rental server will be used.
The pattern is to rent a server such as Xserver , Lolipop, or Sakura Server, install the program for your e- commerce site on it, and then build your e-commerce site.
merit
The overwhelming advantage of the in-house server type is its "freedom". There are things that the ASP type and mall type, which will be explained later, cannot do with the in-house server type, but on the other hand, it becomes necessary to do everything by yourself regarding "security", so there is a considerable limit to what one company can handle with this in-house server type.
Regarding the programs for creating EC sites, there are some that are created completely freely from scratch, and others that are packaged software such as EC-CUBE.
There are also things like " WelCart " and " WooCommerce " that can be used as WordPress plugins.
In recent years, most cases where personal information leaks have become an issue involve this in-house server type .
Why in-house server type data is prone to leaks
The software is installed manually (or by a production company) on a rented server, but the system provides many avenues for attack, which is the biggest reason why it is an easy target.
From a structural standpoint, there are many avenues for attack, starting with the rental server in the case of an in-house server type.
You probably have a login ID and password for this rental server, and this is the first point of attack.
Basically, rental servers are protected by the server company's security, so you can assume that they have fairly strong security, but there is still a possibility that your ID and password may be leaked.
You will then need to install another piece of " e- commerce site software" and, in most cases, log in to the administration screen to set up your e-commerce site and manage your sales.
The EC site's software (CMS) also has a login ID and password. This is the one you use to access the administration screen.
This is the area where in-house server types are most susceptible to security holes.
For example, with WordPress or EC-CUBE , simply adding " /admin " to the end of the domain will often take you to the authentication page or POP for the admin screen.
Both of these methods have security measures in place to prevent access in this way, but there are many sites that don't do this, so there are many ways to reach them easily.
The more well-known a tool is, the more likely it is that there are ``malicious tools'' that can be used to infiltrate through it.
The reason why WordPress and other similar sites, even those used on corporate websites, are prone to tampering is because they can be accessed through these channels.
And if you are running an EC site, if someone breaks into your site, your "personal information" will be stolen. If you put it in the management screen, you can easily download it in CSV format.
The image is something like this
There are two entry routes available.
Of course, the CMS side also provides security tools, but this is a world of cat and mouse, so it is often the case that "what's fine now may not be fine tomorrow."
Security holes are discovered every day. Especially for well-known tools, there are many people looking for ways to attack them, so new holes are found and security updates are continually made.
However, if you install it on your own server, you will need to update it yourself. Even if you update it for security reasons, there may be cases where some functions are not usable. This is one of the characteristics of an in-house server type, which means that management costs can easily increase.
Also, not long ago, e-commerce sites were basically "in-house server type," so older sites were often constantly exposed to this security risk, so caution is required!
If you are using a product that has stopped being updated, it is best to operate it with the mindset that your personal information is being hidden behind a single screen.
In short, if you are targeted, it's over!
I think the benefits of using your own server should be limited to cases where there is a specific function you want to use or a system you want to manage.
For an e-commerce site that is built to that level, construction costs of over 10 million yen are common, so it becomes a challenge only faced by companies that can afford to spend money on security.
If you have a low budget, it's safe to say that security is a significant risk.
ASP-style security
Next, we will explain the ASP type, which has become mainstream in recent years.
The ASP model is a model where you pay a monthly fee to an EC site platform provider and use the system, including the server.
l Shopify
l BASE
l STORES
l MakeShop
l Ecforce
In recent years, we often hear about ASP type services such as these.
In many cases you don't have as much freedom as with your own server, but in recent years some ASP -type services offer around 90% of what you want, and you can get started with a lower budget than in the past, so this is currently the most popular format.
What about security in this case?
Here, we will focus only on the main body.
I say "only the device" because I'm not considering third-party apps here. For more information on third-party apps, please see another blog.
Another blog
In the case of the ASP type, when using your own server there are two entrances, "server" and " CMS ", but since it is integrated with the server, there is only one entrance.
The image is something like this
In other words, the only entrance is the part where you log in to the "administration screen." There are limited routes to intrude from the server side. In other words, the left door is basically only accessible to ASP vendors, so I think it's fair to say that the " ASP provider" is entirely responsible for security.
The login screen for a CMS usually has sophisticated security measures in place, such as two-step authentication, so it is designed to prevent intrusion simply by leaking an ID and password.
And as for the crucial issue of security of the ASP company, you can assume that in most cases it is quite robust.
In particular, the world's most widely used " shopify " must be attacked a considerable number of times every day. I'm not sure if there are any thugs who attack not on an individual basis but on a national level. (I won't say where.)
Think of it as your ASP server fending off an insane number of attacks every day.
If you wanted to have the same level of security on your own server, I think you'd need at least several billion yen.
You can imagine that major ASP servers have that level of robust security in place.
On the other hand, it may be rude to call them weak, but there are quite a few ASPs that lack development capabilities, so in that respect, it is safe to say that the "big name" ones often have stronger security!
This is a world where engineers and the money they spend on them matter...
Mall-style security
You can think of the mall type as basically the same as the ASP type!
The most well-known examples are Rakuten and Amazon , and the structure is such that the server management is also handled by the ``mall'' side.
Management of login IDs for the administration screen is the same as on the ASP side, and two-step authentication is becoming the norm these days.
Again, smaller corporate malls are a little more dangerous.
This is one thing we can't beat the big companies in terms of the quality and quantity of our engineers. Basically, we are attacked less often (because there is less information that can be extracted), but once you are targeted, it's all over.
As for the security of a small operating parent company, it's only a guess, but it's clear that it can't compete with the larger companies.
A quick comparison
A simple comparison image comparing "own server type" and "ASP & mall type" looks like this
With an in-house server model, the entrance to the CMS protrudes a little further out than the entrance to the server.
Just access the top page of the EC site and add "/admin"
This is how the login screen appears.
With this level of access, hackers can try attacks multiple times, so it makes them an easy target for attack .
On the other hand, ASP and mall types usually have this kind of mechanism, and the login screen is
Since email addresses are the entrance to the whole system, which email address can be used to access which sites?
We don't even know the premise. From a hacker's perspective, they can't decide where to attack!
In this case, the only attack possible will be to target the ASP itself, so the possibility of intrusion through the entrance is extremely low!
Security of payment information
Another important part besides personal information is the "payment information" section .
I think the most important thing is the credit card information.
In this regard too, there is honestly a big difference between the "in-house server type" and the " ASP and mall type".
The first time credit card information is leaked is when the "card number" is stored locally. It seems that it was a thing in the past, but I don't think there are many cases of local storage these days.
If you have done so, please panic. If you drop it, it's over! It's like living with a huge compensation bill.
In most cases, the card number is designed so that only the payment company knows it, and the company does not manage it.
Despite this, the reality is that leaks are occurring.
Why does it leak?!
To put it bluntly, in many cases the data is extracted during input .
There are two main ways to extract data when entering it.
l There is a virus on your computer or smartphone.
l Malicious programs are embedded in the payment screen
Regarding the first point, "customer's computer," honestly, there is no way for EC businesses to avoid it. Please think that the only thing you can do is to improve your personal literacy and protect yourself.
The malicious program on the second payment screen is very annoying.
Wouldn't it be safe to say that most of the leaks that have been talked about in recent years follow this pattern ?
It gets stolen from you on this final payment screen.
And what I'm saying is that when you're running an e-commerce business, you end up wanting to tinker with things.
l Easy to understand delivery date and time
l Address Autofill
l I want to get my birthday too
l I want them to sign up for the email newsletter too.
A device to make payment quicker. A device to obtain personal information to increase sales.
You'll want to do a lot of different things, but the high level of customizability means that it's easy to embed any kind of program!
While the selling point of in-house server-based systems is the high degree of customizability , the most common pattern we hear about in recent years is that malicious programs are embedded in the servers, leading to data leaks .
Even if it looks like nothing special at first glance, there is a program embedded in the back that secretly transmits the keyboard information entered by the customer to a malicious organization... Oh, how scary...
On the other hand, ASP-type payment screens have low customizability . They often only allow you to do certain things.
Because of this, there are often many frustrating scenes that make you think, "I wish this part was a little more like this!"
However, on the flip side, there is no room for embedding "malicious programs," so it is quite robust in terms of security .
The same goes for malls. I don't think you've heard of any leaks from Amazon or Rakuten.
So the customizability and security of the payment screen are two sides of the same coin. It's best to think of them as being inversely proportional to each other.
summary
If you are concerned about the security of the e-commerce site you are currently running, or are thinking of starting your own e-commerce site, I recommend that you start with an " ASP type" or "mall type" without hesitation.
If you want to create a large-scale EC site with a considerable budget, you may choose to go with an in-house EC model, but security alone would probably cost several hundred thousand yen per month. It's a good option if you have a site that requires several million yen per month in server management costs and operating costs to run an EC site of that scale.
You will be able to secure staff who are solely focused on security, and the increased freedom may also lead to increased sales.
But I think in most cases that's not the case.
If you are concerned about security, it is often better to switch to an ASP type.
Today's ASPs can do a lot more than they could a few years ago.
Shopify offers about 90% flexibility.
There's no doubt that e- commerce site security will become a very hot topic from 2025 onwards, so be sure to take measures!