E-Commerce

Review how shoppers, support agents, developers, and store administrators authenticate and recover access. Attackers may exploit a service-desk conversation, stolen session, or weak recovery step rather than a software vulnerability. Treat changes to authentication factors and payout destinations as sensitive events.

Psycher can support suspicious-request review, while Argus can inform investigations involving exposed credentials. Establish a documented response to confirmed session theft, including revocation and account recovery. Human operators should approve consequential account actions and distinguish suspicious activity from legitimate travel, accessibility needs, or customer support cases.

• Use strong authentication for store administration.
• Do not rely on password changes alone when sessions or tokens may also be compromised.

Inventory scripts, plugins, tag managers, themes, payment components, and external services that execute in customer-facing pages. Record their purpose and owner, and remove components that no longer serve a business need. Review changes through a controlled release process rather than allowing unrestricted production edits.

Scout and Hunter can support scoped exposure and vulnerability reviews. Testing should include the actual checkout experience and relevant third-party dependencies, with explicit authorization and safeguards against affecting live transactions. A hosted payment service may reduce some responsibilities, but it does not remove the need to secure the surrounding website.

• Restrict who can change checkout scripts and tag-manager settings.
• Investigate unexpected destinations receiving customer or payment-related data.

Prepare for incidents affecting orders, refunds, shipping integrations, and customer communications. Decide how to pause risky functions without unnecessarily disabling the entire business. Preserve enough information to identify affected transactions while avoiding unnecessary collection of sensitive customer data.

Dewey can support recovery coordination and Growler can help organize evidence. The business must approve containment, customer notices, and changes to refund or payment workflows. Exercise a scenario involving a compromised administrator and an untrusted storefront change, then verify that teams can restore a known-good release and reconcile orders.

• Keep protected deployment records and recovery copies.
• Document escalation contacts for hosting, payment, fulfillment, and support providers.