In 2000, the internationally renowned security technologist Bruce Schneier wrote: “Security is a process, not a product”. In the same essay, he wondered: “Will we ever learn?”. Apparently not. How many times have you considered your WordPress application security only once completed? How many times have you installed a security plugin and thought it was enough? Securing a web application doesn’t mean installing a plugin just before deployment. Not at all. I’m very passionate about security and I’d like to share my thoughts with you. My focus will be the security awareness related to web applications. Is WordPress secure? I will answer this question very clearly. And you’re not gonna like it!

1. Thomas Vitale | thomasvitale.com | @vitalethomas
WordCamp Torino 2018 | #wctrn
SECURITY IS A PROCESS,
NOT A PLUGIN

2. THE ENEMY
INTRODUCTION TO SECURITY

3. WHO IS ATTACKING YOUR WEBSITE?
PERSON BOT BOTNET

4. “I have just a small blog.
Who cares?”

5. STEAL DATA STEAL RESOURCES SEND SPAM
ATTACK OTHER WEBSITES EARN MONEY
WHY ARE THEY ATTACKING YOUR WEBSITE?

6. THE IMPACT
INTRODUCTION TO SECURITY

7. WHY SECURITY MATTERS?
TIME REPUTATION LEGAL ISSUES
SEARCH POSITIONING MONEY

8. BUILD A BETTER WEB

9. OUR GOALS
INTRODUCTION TO SECURITY

10. CORE SECURITY GOALS
AVAILABILITYINTEGRITY
CONFIDENTIALITY CIA Triad

11. “I have installed a plugin
for security. I’m good.”

12. SECURITY IS A PROCESS,
NOT A PRODUCT.
Bruce Schneier
The Process of Security, April 2000

13. 1. MANAGE SECURITY
RISKS
SECURITY PRINCIPLES

14. RISK MANAGEMENT
VULNERABILITY THREAT RISK

16. “WordPress is not
secure.”

17. 2. BE RELUCTANT
TO TRUST
SECURITY PRINCIPLES

18. THEMES AND PLUGINS
Trusted
Source

19. TRUST BOUNDARY
YOUR
WORDPRESS
APPLICATION
3rd PARTY
SERVICES
USER
INPUT
HTTP/S
REQUEST
DATA
More on Secure Coding Patterns by Andreas Hallberg

20. DATA VALIDATION
isset()
empty()
in_array()
is_email()
username_exists()
validate_file()

21. SECURING INPUT:
SANITIZING
sanitize_email()
esc_url_raw()
wp_filter_post_kses()

22. SECURING OUTPUT:
ESCAPING
esc_html()
esc_url()
esc_attr()

23. SECURING HTTP/S REQUESTS:
NONCES
wp_create_nonce()
wp_verify_nonce()
wp_nonce_field()

24. USER ROLES AND CAPABILITIES
SUPER ADMINISTRATOR ADMINISTRATOR EDITOR
AUTHOR CONTRIBUTOR SUBSCRIBER

25. 3. PRACTICE DEFENCE
IN DEPTH
SECURITY PRINCIPLES

26. PRACTICE DEFENCE IN DEPTH
CLIENT
NETWORK
HOST WORDPRESS
WEB SERVER
CORE
THEMES PLUGINS
DATABASE

27. 4. STAY UP TO DATE
SECURITY PRINCIPLES

28. UPDATE

29. PRESERVE

30. BACKUP

31. IS
WORDPRESS
SECURE?

32. SECURITY
TECHNOLOGY
PROCESS
PEOPLE

33. 5. SECURE THE
WEAKEST LINK
SECURITY PRINCIPLES

34. PEOPLE ARE
THE WEAKEST LINK

35. SECURITY IS A
SHARED RESPONSIBILITY

36. BUILD A BETTER WEB

37. “Every day, every hour, this very minute perhaps…
Dark forces attempt to penetrate our castle’s walls.
But in the end, their greatest weapon… is you!
Just something to think about.”
Albus Dumbledore

38. NEXT?
RESOURCES

39. RESOURCES
SECURITY & SOFTWARE
▸ The Process of Security (Bruce Schneier)
▸ The Basics of Web Application Security (Cade Cairns, Daniel Somerfield)
▸ Secure Coding Patterns (Andreas Hallberg)
▸ OWASP Top 10 Most Critical Web Application Security Risks - 2017
▸ Software Security: Building Security In, Gary McGraw
▸ Building Secure Software: How to Avoid Security Problems the Right Way,
John Viega and Gary McGraw

40. RESOURCES
SECURITY & WORDPRESS
▸ WordPress Security (WordPress.org)
▸ Hardening WordPress (Codex)
▸ Plugin Security (WordPress Plugin Handbook)
▸ Theme Security (WordPress Theme Handbook)
▸ An Introduction to WordPress Security (Sucuri)
▸ WordPress Security Fundamentals (WordFence)

41. SECURITY IS A
PROCESS,
NOT A PLUGIN
Thomas Vitale |@vitalethomas | #wctrn
This work is licensed under a Creative Commons Attribution 4.0 International License.
Images source: Pexels