WordPress Security Begins With Good Posture

@perezbox | @sucuri_security#wceu


WordPress SecurityIt Starts With Good Posture


Background


“As a species, we are risk adverse when it comes to gains, but risk seeking when it comes to loss…”

- Bruce Schneider, BlackHat 2014

State of Incident Response


Why should I worry about security?


• Audience• Business• Responsibility


“The value of a network is equals the square of the number of users.”

- Metcalf Law – Value of a Network


Attacks come in many formsMalware distribution, email spam, web server abuses, phishing lures


Security begins with Good Posture


Security is about Risk ReductionThe risk will never be zero


As posture increases, risk reduces


Protection

Detection

Response


Maintenance

Protection

Detection

Response


Best Practices/Principles Maintenance

Protection

Detection

Response


“The biggest weakness we face as a community in security is also it’s greatest strength as a platform – its extensibility and ease of use.”

- Tony Perez


Diving into the WordPress Security LifeCycle


Best Practice / PrinciplesThe Foundation


Best Practice/Principles• Defense in Depth

– Layered Defenses

• Principle of Least Privileged– 20 admins?

• Function Isolation (Production vs Staging vs Testing)– Soup Kitchen Servers


MaintenanceIt Begins with Good Administration


Maintenance• User Management

• Backups

• Account Management

• Software Management


ProtectionStopping attacks from impacting your website


Protection• Denial of Service Attacks

• Brute Force Attacks

• Exploitation of Software Vulnerabilities

• Application Hardening


DetectionIdentifying security events


Detection• Activity Monitoring

• Security Scanning

• Malware / Non-Malware Scanning

• Indicators of Compromise


ResponseHow do you address the problem?


Response• Incident Handling

• What’s an Incident?

• Brand / Business Impacts


The WordPress security plugin ecosystem

http://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-ecosystem.html






Access Control – Login33% of infected websites come from poor credentials and user management


Access Control• Whitelisting Access

• Two Factor Authentication

• Password Managers


Online HabitsYour security goes beyond just the application


Online Habits• Local AntiVirus – Mac /

Windows

• Personal Virtual Private Network’s

• Auto Play / Enabled JS


When all else fails, enlist the help of professionals


Get in touchLet’s get social:• Twitter: @perezbox

• Twitter: @sucuri_security

• Facebook: /SucuriSec

Read what I write:• http://blog.sucuri.net

• http://tonyonsecurity.com

https://twitter.com/perezbox

https://twitter.com/sucuri_security

https://www.facebook.com/SucuriSec

https://www.facebook.com/SucuriSec

http://blog.sucuri.net/

http://tonyonsecurity.com/

WordPress Security Begins With Good Posture

Technology

Transcript of WordPress Security Begins With Good Posture