Cybersecurity expert Joe Ohr warns that treating corporate websites as "set-and-forget" assets exposes businesses to severe risks, urging executives to assign clear ownership, audit software like PHP, and implement strict security measures.
- The Business Risk: Neglected websites do not just fail silently; they open the door to brand impersonation, freight fraud, revenue loss, liability, and pathways for cybercriminals.
- The PHP Vulnerability: Major security flaws in essential programming languages like PHP highlight the danger of running outdated website infrastructure without vendor patches.
- The Leadership Audit: Executives need to ask critical questions about website ownership, software inventories, admin access controls, multi-factor authentication (MFA), and data collection policies.
- The Fleet Analogy: Just like a tractor or vehicle fleet requires regular inspections and service intervals, corporate websites demand active maintenance and oversight.
When was the last time you thought about your company website, if you thought about it at all? What is its purpose? Who is the audience? And who keeps it running and its information current? Is it the IT team? The marketing department? An administrative assistant who inherited the job years ago?
In modern business, a company’s website has different roles. It is a digital logo on the company headquarters building that announces that the company exists. It is also a marketing platform that promotes products and services. It is a virtual recruiting office by introducing the company’s people and its culture, then reaching out to job seekers and inviting them to apply for open positions. It is a press room to distribute official statements and news about the company. And it helps court investors.
It is, in effect, the front door to your company on the World Wide Web, open to anyone. Something so vital to operating a modern business is a target for bad actors, who might use that door to steal information and threaten one of a company’s most vital assets: its reputation.
The risk is to the business, not the technology
A neglected website rarely announces itself. It fails quietly, and the bill arrives later in forms every executive recognizes.
Reputation: Bad actors can compromise a website to use your company name and logo. Then they quietly redirect internet traffic to websites that look like yours but instead deliver malicious software to website visitors. They do not blame the bad actors that spoofed the company website; they blame the brand they trusted.
Revenue: A website taken offline for cleanup cannot take quote requests, show shipment status, or accept applications for job candidates. Every hour of downtime negatively impacts business.
Fraud: Freight fraud runs on impersonation. A hijacked site, an abandoned web domain (such as for a company acquired during the last merger) or an outdated contact page gives fraudsters a believable platform to pose as your company, redirect payments, or arrange fictitious pickups.
Liability: Driver applications, customer portals and contact forms collect personal and business information. A breach can bring notification obligations, regulatory scrutiny and hard conversations with shippers who trusted you with their data.
A way inside: Many websites connect to email, customer records or shipment systems. A compromised website can become the foothold for a much larger attack.
How do you spell PHP?
On Oct. 21, the developers of Hypertext Preprocessor (PHP), the programming language behind roughly 70% of websites, released fixes for two critical flaws that researchers nicknamed "PHP2Shell." The flaws were serious because they enabled anyone on the internet to control web servers without any passwords. Then they could gather any data, install malware, and gain access to web server memory, including administrator accounts and passwords—which, if an administrator reused that account on different systems, exposes even more of the company’s infrastructure to bad actors.
The FBI urged organizations to apply updates immediately, or to take systems offline if they could not. Tech companies and researchers reported thousands of attempts in the days after the vulnerability was published.
Put another way, PHP is like the engine in a tractor: nobody sees it, but nothing moves without it. Popular website platforms such as WordPress are built on PHP, as are many company websites. The security firm Qualys found that 71% of PHP installations ran versions so outdated that many will never receive a vendor patch. For those websites, the only remedy is an upgrade, which takes time, money and specialized knowledge to do right.
No fleet manager would run a tractor for years past its service intervals and expect it to pass a roadside inspection. Yet many company websites were built by a vendor or a departed employee, launched with fanfare and then left alone.
PHP is not the only thing
These PHP vulnerabilities are big news for good reason; they are critical risks and thankfully attracted deserved attention from governments and news outlets around the world.
They are not the only things on your company website that might need some work. Look at other aspects of the company’s website to check that security configurations are effective, to reassess design decisions that conflict with current best practices, and to make sure obsolete components are brought up to date.
Ideally, your web administrators already do these assessments as a matter of routine, so it will be a quick status update about what they looked at and what they did. But as we noted earlier, many websites are built and essentially forgotten about.
Five questions for your next leadership meeting
Who owns our website? Name one accountable person, even if a vendor does the day-to-day maintenance. That owner does not need a technical background but should receive regular reports about the health of the company’s websites.
What is the website built with? Are the versions in use still supported? Ask for a simple inventory of the web platform, the scripting languages (like PHP), plug-ins, hosting agreements, backup configurations and data storage. Determine when each component was last reviewed and updated.
Who else has the keys? Web designers, hosting companies and former employees may still have administrator logins. Determine the minimum number of people who still need that level of access and remove the rest.
How many keys do you need? Determine if multi-factor authentication (MFA) is implemented for website administrators and require proof that it is required.
What data does the website collect and where does it go? Review the company’s privacy policy and be sure that company websites and data stores conform to it.
If the site went dark tomorrow, how would it affect operations, and what would we do about it? Perform a business impact analysis to understand what processes would be affected. Confirm there is a business continuity and disaster recovery plan for the website that meets requirements. Then, test those plans and apply any lessons learned.
Your website is often the first impression a shipper, a driver or an investor has of your company. Treat it like the rest of your fleet: Assign an owner, schedule maintenance and inspect it regularly. The prestige of a company symbolized by its logo on the company headquarters means little if the building behind it is falling apart.
