Map your attack surface [Lesson 4 in WordPress Security]

If you want peace, prepare for attacks

Feeling peace of mind will give you a false sense of security, and that leads to even the most security-conscious people we know being hacked.

Expect to become compromised, and you'll know exactly where the entry points are.

Welcome to WordPress Security Lesson #4. It's time to map your attack surface.

Cake, cheese, and cybersecurity: here's what we mean

In cybersecurity, we use the so-called Swiss Cheese Model. It shows that security is a multi-layered thing, and you can never have just one method to keep you 100% safe.

Each layer has flaws which, if aligned, allow incidents to occur.

And while the Swiss Cheese model shows the high-level picture, we use the layered (AKA: the layer cake) model to explain the security layers you should protect:

Layer 1. Protecting your network layer

This is the layer where all your incoming traffic is processed. This is where you should use a good network layer security tool to:

- Mitigate DDoS attacks

- Filter out bot traffic

- Force SSL/TLS encryption

- Ensure all traffic is passed through HTTPS

Typically, you'll use a standard web application firewall (WAF) solution like Cloudflare to filter out traffic that could be malicious.

Layer 2. The server layer

As experts often say: "There is no cloud. There's only ever someone else's computer." And servers, much like any other computer, have operating systems and software that need to be kept up-to-date to prevent hacks.

Unless you find yourself suddenly coming into wealth in the form of server rooms in Iceland, you'll most likely use managed WordPress hosting that should provide the following services:

- Server configuration and isolation: If you purchase space on a shared server, if one service is attacked, the rest can be compromised, too.

- Server-side malware scanning: Don't rely on malware scanning plugins, which are typically the first to be tampered with in an attack. Instead, get hosting with server-side scanning.

- Regular backups

Avoid shared hosting. Like with server isolation, if a site on the shared hosting plan is compromised, attackers would be able to access others on the same server.

Layer 3. The application layer

Remember the last email and how we showed just how easy it is to use plugin vulnerabilities instead of going through the trouble of social engineering?

Your application layer security protects you here. But it's also the most exposed layer.

Why is the application layer such a problem?

This layer is where the software changes most frequently, is often untested, and requires the most frequent maintenance. Oddly enough, it's the least maintained by managed WP hosts.

This is also where access is most often given to others. It's not just the site owners, it's freelancers, marketers, and everyone else who needs to make changes.

Whoever has the Admin privileges can compromise the entire layer.

How to protect your application layer

The decisions you make here have the biggest impact to the overall security of your WordPress site. In fact, the majority of the WordPress hacking incidents happen because something in this layer failed.

Step 1. Choose the right WordPress stack

Choose your plugins and themes based on:

- Functionality: More plugins mean more complexity and more hacking entry points. Choose plugins that stick to their specific purpose and don't try to do everything at once.

- Code quality: Code that is well maintained and documented is less likely to include bugs and security vulnerabilities.

- Security practices: Plugins should have a security point of contact and should release security patches without delay. If they're also a part of Managed Vulnerability Disclosure Programs like Patchstack's, that's a big plus.

- Reputation: Choose trusted developers who are active at providing support and in community discussions.

For example, there has recently been an incident where a plugin developer intentionally added a backdoor to prevent the piracy of their plugin:

Step 2. Don't just rely on developers

As we showed you in the previous emails, developers can't always issue an update in time. And you might not be by your computer the moment a vulnerability is discovered and/or exploited.

Rely on maintenance and vulnerability monitoring.

Update your plugins as soon as possible and prioritize the ones that are security fixes.

Use vulnerability management and mitigation.

Security vulnerabilities can become mass-exploited in a matter of hours. To reduce the risk, get help from security services that create vulnerability-specific mitigation rules.

Mitigation rules are activated on your site automatically without changing the code or disrupting your performance, instantly blocking the ability to exploit the vulnerability.

Step 3. Proper access management

Not every user on the site needs administrator rights. In most cases, Author role is more than enough for people who work on the website content.

Enforce 2FA or MFA (two or multi-factor authentication) on all accounts Contributor or higher. Fortress and Solid Security are great providers for access management security.

Finally, when you're done, log out of your account. Ask others to do the same.

Your homework

Once you look at the different aspects of your website and identify the vulnerabilities in each, you'll know where you need reinforcements.

As homework, make a list of the different layers you manage for your site(s). Then, go through the 3 layers we mentioned and identify any gaps.

Maybe you don't have application-layer protection. Or, perhaps, your host doesn't offer backups. But now that you know where you're weak, you can become stronger!

If you have any questions, just hit "Reply" and let us know.

See you tomorrow!

💚 from Patchstack