Articles

CERTFR-2024-ALE-004 : Vulnérabilité dans Fortinet FortiOS (09 février 2024)

, , ,

Le 8 février 2024, Fortinet a publié l’avis de sécurité concernant la vulnérabilité critique CVE-2024-21762 affectant le VPN SSL de FortiOS. Cette vulnérabilité permet à un attaquant non authentifié de provoquer une exécution de code arbitraire à …
Source de l’article sur CERT-FR

/par
Déploiement WordPress: Docker, Nginx, Apache et SSL

Déploiement WordPress: Docker, Nginx, Apache et SSL

,

Déployer WordPress avec Docker, Nginx, Apache et SSL peut être une tâche complexe. Mais avec les bons outils et la bonne connaissance, vous pouvez le faire facilement!

## Facilitez le déploiement de votre site Web WordPress avec notre guide facile à suivre. Utilisez Docker Compose, Nginx, Apache et SSL pour un processus d’installation sans heurts. Nous créerons également des volumes afin que les modifications ou mises à jour soient préservées lorsque le conteneur redémarre.

Data is the lifeblood of any website, and it’s important to ensure that your WordPress site is properly backed up. With this guide, you can easily set up a backup system that will keep your data safe and secure.

Avec notre guide facile à suivre, simplifiez le déploiement de votre site Web WordPress. Utilisez Docker Compose, Nginx, Apache et SSL pour un processus d’installation transparent.

Nous allons également créer des volumes afin que les modifications ou mises à jour soient préservées lorsque le conteneur redémarre.

Les données sont le sang de la vie de tout site Web et il est important de s’assurer que votre site WordPress est correctement sauvegardé. Avec ce guide, vous pouvez facilement configurer un système de sauvegarde qui protégera vos données en toute sécurité. Une bonne sauvegarde est la clé pour assurer la sécurité et la disponibilité des données. C’est pourquoi il est important de planifier et de mettre en œuvre un système de sauvegarde efficace.

Une fois que vous avez mis en place votre système de sauvegarde, vous pouvez commencer à sauvegarder régulièrement vos données. Il existe différentes méthodes pour sauvegarder vos données, notamment la sauvegarde manuelle, la sauvegarde automatique et la sauvegarde sur le cloud. La sauvegarde manuelle est le moyen le plus simple et le plus rapide de sauvegarder vos données. Cependant, elle nécessite une attention constante et peut être fastidieuse. La sauvegarde automatique est plus pratique car elle peut être programmée pour se produire à des moments prédéfinis. La sauvegarde sur le cloud est également une option pratique car elle permet de stocker vos données sur un serveur distant, ce qui signifie qu’elles seront toujours disponibles et sûres.

Une fois que vous avez mis en place votre système de sauvegarde, vous pouvez commencer à sauvegarder régulièrement vos données. Il est important de planifier des sauvegardes régulières afin de s’assurer que les données sont toujours à jour et que les fichiers ne sont pas corrompus. Vous pouvez également configurer des alertes pour vous avertir lorsque des sauvegardes sont effectuées ou lorsque des problèmes surviennent. Enfin, assurez-vous que vous stockez vos données dans un endroit sûr et que vous les protégez contre les virus et autres logiciels malveillants.

En suivant ce guide, vous serez en mesure de simplifier le déploiement de votre site Web WordPress et de mettre en place un système de sauvegarde efficace pour protéger vos données. Vous pouvez également configurer des alertes pour vous avertir lorsque des sauvegardes sont effectuées ou lorsque des problèmes surviennent. Enfin, assurez-vous que vous stockez vos données dans un endroit sûr et que vous les protégez contre les virus et autres logiciels malveillants.

Source de l’article sur DZONE

/par

CERTFR-2023-ALE-004 : Vulnérabilité dans les produits Fortinet (13 juin 2023)

, , ,

Le 12 juin 2023, Fortinet a publié un avis de sécurité concernant la vulnérabilité CVE-2023-27997. Celle-ci permet à un attaquant non authentifié d’exécuter du code arbitraire à distance sur des produits Fortinet qui proposent une fonctionnalité de VPN SSL.

Dans une …
Source de l’article sur CERT-FR

/par

4 Major Steps Of Web Application Penetration Testing

,

In the early days of the internet, security was little but an afterthought. Then as hackers started to exploit businesses’ lax security postures, things gradually started to change. At first, nonprofits like the Electronic Frontier Foundation started pushing web users to embrace HTTPS Everywhere. In response, certification authorities began offering free SSL certificate variations to any site admin that wanted one. As a result, at least 79.6% of all active websites now use SSL.

That was only the beginning. In the ensuing years, developers and web application administrators gradually started to harden their apps against all manner of attacks. They rolled out more complex password requirements. They started to add two-factor authentication as a default measure. They even started putting public-facing services behind high-performance web application firewalls.

Source de l’article sur DZONE

/par

3 Best Website Uptime Monitoring Tools 

,

An unreliable, semi-broken and unresponsive website is an excellent way to lose leads and visitors — regardless of how aesthetically pleasing or well-designed, the visual elements are.

Over the past decade, we’ve seen more initiative to deliver faster internet to regions of the world that were previously devoid of it. With online communities expanding and more people becoming receptive to online shopping, ensuring your site’s dependability is now more important than ever. 

One way to achieve this is by employing uptime and downtime monitoring tools. This guide will examine the best ways to get alerts when something goes wrong and your website falters.

Why Is Website Uptime Monitoring Important?

Downtime is bound to occur occasionally. Nonetheless, the goal is to minimize it. The longer the downtime occurs, the more traffic and potential clients you lose. A dysfunctional website is also detrimental to your credibility and reputation. People may associate your website’s unreliability with your real-world products or services.

With web developers charging an average of $200 per hour, high-quality websites can be expensive to build and maintain. Nevertheless, it’s often worth the investment. However, an unreliable website can backfire on you. Instead of attracting more customers, it could potentially repel them. This can result in lost revenue.

An uptime monitoring solution can help you prevent or reduce these losses. It verifies if your website is up and functional and notifies you if it’s not. This allows you to troubleshoot the issue and get your website back up and running as soon as you’re alerted. The most common issues behind your website’s downtime include: 

  • Server faults;
  • Network outages;
  • Power outage;
  • Traffic spikes;
  • Cyberattacks;
  • Domain name issues;
  • An erroneous web application deployment;
  • Increased server loads;
  • DNS Resolve issues;
  • Human error.

Thus, you must employ a dependable tool that detects downtime or any interruptions related to your website as soon as they occur. They are must-have tools for web designers, developers, and network administrators. However, not all of them are built the same. So how do you identify the best uptime monitoring tools?

Essential Features of Uptime Monitoring Tools

Uptime monitoring tools typically detect interruptions by running network tests such as pings and trace routes. You could practically monitor your website’s uptime by constantly running these tests yourself. 

However, this isn’t an efficient way to monitor your website’s uptime. A comprehensive uptime monitoring tool will automatically monitor your website’s uptime in the background. It will then alert you through various channels as soon as it senses that your website may be down. 

Furthermore, high-quality uptime monitoring solutions tend to offer additional information regarding your website’s uptime/downtime and its performance. These tools commonly feature dashboards, status pages, badges, exportable records, etc., to help you keep track of your site’s overall health.

9 Best Features of an Uptime Monitoring Solution

The ideal uptime monitoring tool or service should feature: 

  1. Website security features that notify of and repel potential cyber attacks;
  2. 24/7 uninterrupted background website monitoring;
  3. Multi-channel alerts (email, SMS, push notifications, instant messages, social media, etc.);
  4. Report generation;
  5. 24/7 customer support available through different channels (email, phone, chat, etc.);
  6. Be capable of monitoring multiple websites and proxies at the same time;
  7. Offer insights and suggestions to improve your website’s performance;
  8. Be affordable;
  9. High customizability should allow you to choose which features to enable and disable.

Another optional feature to look out for is public status pages that your clients can access to determine if all your services are up and running. GetWeave is an excellent example of this. The website features a well-organized systems status page where customers can check if all of Weave’s services are functional. 

Nevertheless, you can use the above information as a buying guide when assessing potential uptime monitoring tools. The rest of this guide will supply a few suggestions as to which tools you should use for your website.

3 Best Website Uptime Monitoring Tools 

Some of the best uptime monitoring tools for website downtime alerts include:

1. Uptrends

Uptrends isn’t just a downtime detection tool; it’s a complete web performance monitoring solution. It will notify you as soon as it detects any disturbance in your website’s performance. It features highly customizable checks. For instance, you can set performance check limits for load times. Uptrends will notify you instantly if your website takes too long to load.

You can also configure from which locations you want it to monitor your website. Uptrends will then point you to where your website usually suffers performance dips in the real world. 

The service uses multiple communication channels to send users notifications: email, phone calls, and SMS. Alternatively, you can download one of Uptrend’s mobile applications and receive push notifications. Additionally, you can integrate Uptrends with messaging and communication applications such as PagerDuty, Slack, and Microsoft Teams.   

Another impressive Uptrend feature is its ability to emulate your website’s performance on different browsers. It runs Google Chrome, Mozilla Firefox, and Microsoft Edge on its servers. Thus, you can compare how your website runs on these web browsers without installing them on your servers or computer. 

Uptrends supplies users with various charts, reports, and graphs to help identify sudden spikes or dips. Waterfall reports display the complete page-load from the initial request to the last download. This allows you to compare the history of your website’s performance element by element. It comes with three price plans whose costs depend on the number of monitors you would like. Starting at $16.21 (at the time of writing) the Starter Plan is the most affordable.

2. Oh Dear

Oh Dear is a slightly cheaper option than Uptrends, with the most affordable plan starting at $12 per month (at the time of writing). However, while Uptrends offers a 30-day free trial, Oh Dear only provides a 12-day trial period. Nevertheless, Oh Dear’s interface is a lot cleaner and more minimal. 

Since Oh Dear runs servers in different locations across the globe, it can track how your website performs in various regions. Oh Dear will scan through your website and index all the pages. If it detects any issues, it will alert you immediately. 

Oh Dear also features a continuous certificate monitoring function. Site owners who are concerned with their website’s security may find this feature to be especially useful. It will verify your SSL certificate expiration dates and alert you of any changes.  

Oh Dear’s public status page enables your clients to keep track of your website’s availability.

Oh Dear uses email and SMS text messages to alert site owners of any issues. It also features integrations with communications and social media applications such as Telegram, Discord, Slack, Microsoft Teams, etc. Oh Dear ensures that messages are as detailed and user-friendly. This makes it easier to troubleshoot and find the origin of your problem. Oh Dear is more than a worthy alternative to Uptrends. 

3. WP Umbrella

WP Umbrella is a little different from the previous entries. It’s intended to help users manage and monitor multiple WordPress sites. Thus, it is far more particularized in its approach to website uptime monitoring. Again, as is the primary function of the uptime monitoring tool, it offers a real-time alert system that will contact you through email, SMS, Slack, etc. 

WP Umbrella employs a simple minimal UI. Its main screen consists of a dashboard that allows you to view all your WordPress websites. By default, this dashboard features four columns: Site, Uptime, Speed, and Issues.

WP Umbrella will alert you of any outdated or erroneous plugins or themes. While it doesn’t offer dedicated public status pages, it does have a client report generation feature. You can automatically send these reports to your various subscribers or clients when your website is down. 

WP Umbrella is the most affordable option on this list. Users are charged $1.99 per month (at the time of writing) for each website monitored. In addition, WP Umbrella offers a 14-day trial and does not require your credit card details. It’s an excellent option for anyone running a WordPress website or two.

Conclusion

This guide has only explored three possible uptime monitoring solutions. They won’t only assist you in detecting downtimes, they can also help you find the reason your site may be slow.

These solutions are an excellent place to start. But there are many other options coming to market all the time. You may find that this is the first step to converting more leads and reducing your bounce rate. 

Source

The post 3 Best Website Uptime Monitoring Tools  first appeared on Webdesigner Depot.

Source de l’article sur Webdesignerdepot

/par

Using CockroachDB Workloads With Kerberos

,

GSSAPI authentication is becoming increasingly popular as CockroachDB starting to make inroads in Fortune 2000 customer bases and financial services segment. That said, ecosystem coverage for GSS needs to improve for parity with other authN methods. Today, we are providing a workaround and a look at the future. By the way, do you realize this is my 15th article on Kerberos and CockroachDB?

Articles Covering CockroachDB and Kerberos

I find the topic of Kerberos very interesting and my colleagues commonly refer to me for help with this complex topic. I am by no means an expert at Kerberos, I am however familiar enough with it to be dangerous. That said, I’ve written multiple articles on the topic which you may find below:

Source de l’article sur DZONE

/par

WSO2 API-M 3.2.0: Creation of a New KeyStore With a New Self-Signed Certificate and CN

,

This article describes the steps to create a new KeyStore with a new self-signed SSL certificate and a new CN (Common Name) in WSO2 API-M 3.2.0 and how it can be used to invoke APIs’ in WSO2 from a remote host. By default, WSO2 API-M has a KeyStore named wso2carbon.jks which contains a self-signed certificate. However, the default certificate has Common Name (CN) as localhost and this certificate can be used to invoke the APIs from the same server where WSO2 API-M is hosted. This article is useful when the client/end-user wants to invoke APIs exposed via WSO2 gateway that is hosted on a remote server and using an SSL certificate.

Steps:

1.  Open a command prompt and go to <API-M_HOME>/repository/resources/security/. Then, create the new KeyStore that includes the private key by executing the following command. We will provide the hostname/domain name where WSO2 API-M is hosted as the CN value while creating this new KeyStore. For example, in this case, it is api.test.wso2.com.

Source de l’article sur DZONE

/par

The Top 5 Form Types to Use in Your Web Design 

,

There are a lot of factors that contribute to a better user experience on a website. Pages need to load quickly to give users peace of mind and efficiency. Navigation must be clear and straightforward, with direct pathways for visitors to follow when finding your contact pages, blog posts, and products. Your colors need to work seamlessly together while providing just enough contrast in the areas that need it most.

Excellent user experience needs to be considered for every part of your website that acts as a touchpoint with a potential customer or user.

One of the most significant touchpoints of all is your forms.

All websites need some form of interactive content to thrive. Users need to be able to do something with the site, whether it’s looking for information with a search bar, contacting a team for a quote, making a booking, or completing a purchase. Forms power the majority of the interactive activities available on websites.

If you know how to master great UX on a form, you can contribute to more meaningful interactions between your brands and their customers. But not all web forms are the same. Here are some of the top types of forms you need to master and how you can optimize them.

The “Opt-In” Form

The Opt-in Form is probably the best-known form in the digital landscape. It’s essentially a form that asks visitors to “opt-in” to a specific offer. Sometimes, this means signing up for a webinar; other times, it’ll be agreeing to an email newsletter or a regular series of blog updates.

Opt-in forms grab attention quickly and ask for something specific from the audience. For instance, this example from HuffPost encourages visitors to “Subscribe to the Morning Email.”

Opt-in forms are all about generating action.

Sometimes, they’re placed at the bottom of a landing page after a company has had a chance to explain precisely what they’re offering. Other times, you’ll find the opt-in form situated on a sidebar of a website, constantly enticing people to “sign up” if they like what they see on a blog post or article.

It’s also common for opt-in forms to appear as pop-ups and exit pop-ups on modern websites. For example, a brightly colored opt-in form that promises an immediate benefit to a customer could encourage them to hand over their details before they abandon your website.

How to Design a Great Opt-In Form

So what kind of best practices go into an excellent opt-in form?

  • Start with simplicity: If you’re asking your visitors to do something, don’t overwhelm them with too big of a request straight away. Keep the form short and simple, so it doesn’t seem like too much extra work for the visitor. Something like “Subscribe to our newsletter” should ask for nothing more than an email. 
  • Highlight the benefits: Most customers won’t want to give you a place in their inbox or the opportunity to interact with them further unless you can offer something in return. Even if you’re asking for something small, like an email address, let the customer know what’s in it for them. In the HuffPost example above, the company highlights that you can wake up to the day’s “most important news.” 
  • Give the visitor the power: Let your visitor know they’re in control here. They want to see that they’re getting exactly what they need from you in exchange for their contact details. This means reassuring them that their email address won’t be used for spam, like H&B Sensors does here: 

The Contact Form 

The Contact Form is another crucial part of building an effective UX for your website – but it’s also an element that web designers and business owners often overlook. When customers decide they want to learn more about a business, they need a quick and easy way to get in touch.

Contact forms need to be easy to find and use on any website. Usually, your user will expect to see a link to the contact form situated somewhere at the bottom of your webpage. It might be called “Contact Us” or “Customer Support.” Avoid anything that would go over the user’s head.

Aside from being easy to track down, your contact form also needs to reassure an audience that they’re making the right decision by getting in touch. Therefore, the content needs to be short, sweet, and authoritative—highlight why the user might contact your company and how they can do so.

Avoid any unnecessary information in the contact form. For example, you don’t need to know your client’s age and their job to answer a question about where their nearest physical branch is. Keep form fields to the point, or you’ll chase customers away.

How to Design a Great Contact Form

Design something personalized but straightforward to make the most of your contact form. Use features like smart content and conditional logic, if possible, to adapt the page to the user’s needs. Dynamic content is becoming increasingly valuable these days. Other best practices include:

  • Set the right expectations: Let your customers know how active you are and how quickly they can expect to hear back from you. Imagery and the right fonts can also set expectations about the kind of communication your audience can expect. For example, this contact page from the Marvel app is fun and playful, like the company itself:

  • Provide multiple options: If your customer doesn’t want to use your contact form, give them another way to get in touch. Ensure the contact page includes information like where to find you on social media and your professional phone number. 
  • Simplify things on your end: To ensure that you can contact your audience as quickly as possible, allow your customers to choose a specific subject that their query is connected to. Allowing them to choose “Sales” or “Order issues” means you can automatically direct the message to the right team member on the back-end. 

The Online Payment Form 

Sometimes, when your customers have seen what you have to offer and they’ve checked out the competition, they decide to go ahead with their purchase. To facilitate this, you’re going to need an online payment form. Online forms ensure that your customers can safely enter their credit or debit card details to purchase whatever you have to offer.

Most payment processing companies like PayPal, Square, and Stripe come with payment forms included, so you can easily embed them into a website in minutes. However, there’s always the option to customize those payment forms.

For instance, ideally, you’ll need a payment form that keeps your customer on the same page, so they don’t have to log into another browser to make their purchase. The fewer transitions your client has to make, the safer they’ll feel.

How to Design a Great Payment Form

When designing any payment form, simplicity and security are the two most important factors. Your customer should be able to enter their information quickly and easily and get through the transaction process without worrying about their details.

Remember to:

  • Keep it simple: The fewer fields the visitor has to fill out, the better. Customers still feel uncomfortable sharing personal information and payment details online. Make the experience as painless as possible. If your client already has an account with your business, you might create a system that automatically fills some of the fields, such as their email address, name, and billing address. 
  • Offer the right integrations: The proper payment forms will integrate with the payment services your customers prefer to use. Options include PayPal, Stripe, Square, Verified by Visa, and Mastercard. Get a developer to integrate the right APIs with your form to give your customers the broadest range of options. 
  • Ensure security: Give customers peace of mind by providing as much security evidence as possible. An SSL certificate that places the padlock on the top of the browser next to the URL is a great way to make customers feel more secure. Integrating verification options so your customers can avoid fraud issues is another significant step. Sometimes just putting logos from the card types you accept on the page will make a customer feel more secure. 

Support Forms

Some companies bundle the contact form and the support form together. Others have a separate support form to get their queries routed directly to the people most capable of helping them. If you want to take the second route, it might be a good idea to design a “help” section on your website where you can locate the support form.

The “Help” section on a site often appears alongside other links on the footer. For instance, it could appear alongside “About” links and “Contact” options. Here’s an example of Hubspot’s Customer Support options:

The best customer support pages come with various ways for clients to help themselves and find answers to their most pressing questions. For example, you might have a search bar where your audience can search for the answers to their queries or a knowledge base full of helpful blogs.

Hubspot allows users to choose between a blog, knowledge base, academy training center, community forum, developer discussion board, and assistance from a certified partner.

How to Design a Great Customer Support Form

Designing a good customer support form is about getting your audience the information they need as quickly as possible. Once again, you’ll need to stick to as few form fields as possible here to avoid angering an already frustrated customer. Also, remember to:

  • Ask for the right information: Find out what the query is about by giving the customer a drop-box menu full of possible topics to choose from. If you need a product reference number or something similar, ask for that at the top of the form, then allow the customer to provide extra information about their query underneath. 
  • Set expectations: Let your customers know when they can expect to get a response to their concerns and provide them with advice on what to do next. For instance, you could invite them to check out your knowledge base while they wait for a response. 
  • Keep it simple: Avoid using technical jargon on your support request forms. Be direct in your requests for summaries of the issue at hand, contact information, and other supplemental data. 

Customer Feedback Forms

According to Microsoft, around 96% of customers say that customer service is crucial in determining their loyalty to a specific brand. Another 52% of global customers believe that companies need to respond to the feedback provided by customers.

To ensure your customer service strategies are on-par with what your customers expect, you need to get feedback from your audience. That’s where a feedback form comes in. Customer feedback forms often appear after a client has finished purchasing on the “thank you” screen. They may also occur after a customer has completed a service interaction online.

Here’s an example of an Apple feedback form:

How to Design a Great Customer Feedback Form

By leaving you feedback, your customer is doing you a massive favor. They’re giving you a chance to learn from your mistakes and improve the service you can give next time around. Feedback is one of the best tools for any business that wants to grow and thrive.

If you want your customers to use your feedback forms, you’ll need to make them as simple as possible. Your customers don’t have time to waste on a complex form.

  • Don’t make any fields mandatory: Don’t stop your customers from submitting a form unless they’ve completed every field. Allow them to enter the information they consider to be the most important, and that’s it. You can even fill some of the form out for your customer, if possible, by entering their name and email address if they’re already a member of your site.
  • Make it mobile responsive: Remember there are around 3.5 billion smartphone users worldwide. You can’t afford to lose feedback because your form isn’t responsive. Every form should look and feel incredible on any device. 
  • Include a rating option: If your customers don’t have much to say about your service, or they’re not wordsmiths, they might prefer a rating option instead. A one-to-five rating system that allows your customer to judge your product or service on a scale of poor to wonderful is a great way to gain quick information. Check out the Uber Engineering example here:

Though you can pre-enter some information on a feedback form to make your customer’s life easier, don’t overstep your bounds. Adding your customer’s email address to the form is fine if they’re already a customer with you. Pre-selecting the “very satisfied” rating above would look presumptuous.

Top Tips to Improve Every Form Design

The online form is an essential part of any web design project, but it’s also frequently overlooked. Unfortunately, without a good set of forms, your customers will struggle to interact with your company in a meaningful way.

When creating any form, remember:

  • Reduce friction: Reduce the friction for your customers by asking as few questions as possible. The less your customer has to answer, the better. If you can pre-populate forms with information like your customer’s name and email address, this could help. 
  • Keep it simple: Make sure that the form is clean and easy to use. Your customers shouldn’t be confused about where to click or how to submit their information. A single-column design is often better than a multi-column option.
  • Be clear in error messages: Don’t just tell your visitors that something has gone wrong. Let them know what they need to do to submit the form successfully. If possible, use inline validation with real-time feedback to let your audience know that you recognize the information they’ve submitted.
  • Keep data secure: Make sure your audience feels safe by letting them know how you will use this information and why you’re asking for it. If you’re asking for an email address, make the benefits of entering that information clear. 
  • Make fields optional: Allow your audience to add more information to a form if they want to – but don’t demand it. Give some freedom to the visitor. 

The better your forms are, the more effective your interactions with customers will be. Remember, it’s not just the face-to-face interactions that your customers judge when making decisions about your business and whether to trust you. Today’s digital world has prompted a new demand for more meaningful virtual experiences.

Your form could be the first interaction you have with a client, whether it’s a contact form, a booking form, or something else entirely. Get that right, and you can improve your chances of your customers coming back to interact with you again later.

 

Featured image via Pexels.

Source

The post The Top 5 Form Types to Use in Your Web Design  first appeared on Webdesigner Depot.

Source de l’article sur Webdesignerdepot

/par

Top 10 August ’21 Security Articles to Read Now

,

Introduction

Security is one of the most important aspects of modern-day applications. As technology keeps getting advanced, keeping the security up-to-date is a challenge. How awesome would it be to find top trending articles in the Security Zone in one place so that you can always stay up to date with the latest trends in technology? We dug into Google analytics to find the top 10 most popular Security articles in August. Let’s get started!

10. Spring Boot Security + JWT  »Hello World » Example

Spring Boot applications have been a key in implementing the microservice architecture. Learn how to implement security in Spring Boot with JWT token. Follow the step-by-step tutorial and secure your Spring Boot microservice.

Source de l’article sur DZONE

/par