Content Management

Web security overview

OWASP

Top 10 vulnerabilities (data from 2013 below)

1. Injection
2. Broken Authentication and Session Management
3. Cross-Site Scripting (XSS)
4. Insecure Direct Object References
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Missing Function Level Access Control
8. Cross-Site Request Forgery (CSRF)
9. Using Known Vulnerable Components
10. Unvalidated Redirects and Forwards

More info: Gary Hockin: top 10 OWASP at PHPUK 2015

Injections attacks

phpsecurity documentation

• SQL Injection
• Code Injection
• Log Injection
• Path Traversal
• XML Injection

Authentication and sessions

• Check browser user agent
• Check session remote IP address

Example: Zend Session Validator

Authentication and sessions

• Two Factor authentication

More info: Rob Allen: Secure your app with 2FA - PHPNW 2015

Brute force attack

Fortunately, there is an article on brute force attacks on WordPress codex.

• Don't use "admin" as username (easy)
• Use good password (recommended)
  • Do not force complex passwords! => bad UX
  • Do not force complex passwords! => people write them down
• Limit number of login attempt

Cross site scripting

Inserting unwanted script (usually javascript) to retrieve any user information and send it somewhere to be stored.

Codecourse: PHP Security: XSS (Cross-site Scripting)

Transport layer security

SSL/TLS

Don't send unencrypted password on the network!

SSL certificate videos on ServersForHackers

Using Known Vulnerable Components

• Update your servers (PHP, Mysql, Apache, Nginx)
  • CVE Security Vulnerability Datasource
  • PHP versions
• Update WordPress, themes and plugins
  • Disable auto-update for versionning, screen code in diffs
• Source your plugins and themes correctly
  • Read the code
  • Use blog posts from security experts

Extending WordPress

Security

User authentication

Prevent brute force

• Security through obscurity (false security): use a trusted plugin to move the login page.
• Source and find a trustworthy anti brute-force plugin.
• Depending on your context, send email for each person logged in as administrator, or watch your logs with automated tasks.
• Don't use the admin username: WordPress Codex: Brute force attacks.

User authentication

Use Two Factors Authentication

Consider users passwords as compromised (some people use the same password everywhere).

Use a known plugin, don't write your own.

Explain to your users, they will not understand. Explain why, and how.

Themes / Plugins

Filter inputs, escape outputs, never trust user input.

Data from database or APIs are considered as user input, as they can be modified somewhere.

Miscellaneous

• Don't auto-update, keep control on the files.
• Disable the file editor.
• Disable plugin/theme uploaders.
• Use a local configuration file (out of the document root), or use environment variables.

WordPress version control tips

Miscellaneous

WordPress Codex: Changing file permissions

Only cache, session and upload folders should be writable. Cache and sessions are optional.

Next week

Improve your WordPress security

Questions?