In 2000, the internationally renowned security technologist Bruce Schneier wrote: “Security is a process, not a product”. In the same essay, he wondered: “Will we ever learn?”. Apparently not. How many times have you considered your WordPress application security only once completed? How many times have you installed a security plugin and thought it was enough? Securing a web application doesn’t mean installing a plugin just before deployment. Not at all. I’m very passionate about security and I’d like to share my thoughts with you. My focus will be the security awareness related to web applications. Is WordPress secure? I will answer this question very clearly. And you’re not gonna like it!

1. Thomas Vitale | thomasvitale.com | @vitalethomas
WordCamp London 2018 | #wcldn
SECURITY IS A PROCESS,
NOT A PLUGIN

2. THE ENEMY
INTRODUCTION TO SECURITY

3. WHO IS ATTACKING YOUR WEBSITE?
PERSON BOT BOTNET

4. “I have just a small blog.
Who cares?”

5. STEAL DATA STEAL RESOURCES SEND SPAM
ATTACK OTHER WEBSITES EARN MONEY
WHY ARE THEY ATTACKING YOUR WEBSITE?

6. THE IMPACT
INTRODUCTION TO SECURITY

7. WHY SECURITY MATTERS?
TIME REPUTATION LEGAL ISSUES
SEARCH POSITIONING MONEY

8. OUR GOALS
INTRODUCTION TO SECURITY

9. CORE SECURITY GOALS
AVAILABILITYINTEGRITY
CONFIDENTIALITY CIA Triad

10. “I have installed a plugin
for security. I’m good.”

11. SECURITY IS A PROCESS,
NOT A PRODUCT.
Bruce Schneier
The Process of Security, April 2000

12. 1. MANAGE SECURITY
RISKS
SECURITY PRINCIPLES

13. RISK MANAGEMENT
VULNERABILITY THREAT RISK

15. “WordPress is not
secure.”

16. 2. BE RELUCTANT
TO TRUST
SECURITY PRINCIPLES

17. THEMES AND PLUGINS
Trusted
Source

18. TRUST BOUNDARY
YOUR
WORDPRESS
APPLICATION
3rd PARTY
SERVICES
USER
INPUT
HTTP/S
REQUEST
DATA
More on Secure Coding Patterns by Andreas Hallberg

19. DATA VALIDATION
isset()
empty()
in_array()
is_email()
username_exists()
validate_file()

20. SECURING INPUT:
SANITIZING
sanitize_email()
esc_url_raw()
wp_filter_post_kses()

21. SECURING OUTPUT:
ESCAPING
esc_html()
esc_url()
esc_attr()

22. SECURING HTTP/S REQUESTS:
NONCES
wp_create_nonce()
wp_verify_nonce()
wp_nonce_field()

23. USER ROLES AND CAPABILITIES
SUPER ADMINISTRATOR ADMINISTRATOR EDITOR
AUTHOR CONTRIBUTOR SUBSCRIBER

24. 3. PRACTICE DEFENCE
IN DEPTH
SECURITY PRINCIPLES

25. PRACTICE DEFENCE IN DEPTH
CLIENT
NETWORK
HOST WORDPRESS
WEB SERVER
CORE
THEMES PLUGINS
DATABASE

26. 4. STAY UP TO DATE
SECURITY PRINCIPLES

27. UPDATE

28. PRESERVE

29. BACKUP

30. IS
WORDPRESS
SECURE?

31. SECURITY
TECHNOLOGY
PROCESS
PEOPLE

32. 5. SECURE THE
WEAKEST LINK
SECURITY PRINCIPLES

33. PEOPLE ARE
THE WEAKEST LINK

34. SECURITY IS A
SHARED RESPONSIBILITY

35. BUILD A BETTER WEB

36. NEXT?
RESOURCES

37. RESOURCES
SECURITY & SOFTWARE
▸ The Process of Security (Bruce Schneier)
▸ The Basics of Web Application Security (Cade Cairns, Daniel Somerfield)
▸ Secure Coding Patterns (Andreas Hallberg)
▸ OWASP Top 10 Most Critical Web Application Security Risks - 2017
▸ Software Security: Building Security In, Gary McGraw
▸ Building Secure Software: How to Avoid Security Problems the Right Way,
John Viega and Gary McGraw

38. RESOURCES
SECURITY & WORDPRESS
▸ WordPress Security (WordPress.org)
▸ Hardening WordPress (Codex)
▸ Plugin Security (WordPress Plugin Handbook)
▸ Theme Security (WordPress Theme Handbook)
▸ An Introduction to WordPress Security (Sucuri)
▸ WordPress Security Fundamentals (WordFence)

39. SECURITY IS A
PROCESS,
NOT A PLUGIN
Thomas Vitale |@vitalethomas | #wcldn
This work is licensed under a Creative Commons Attribution 4.0 International License.
Images source: Pexels