Security Implications of WordPress in The Enterprise
My Chileno brother from another mother, Chris Lema, put out a great guest post on WPEngine yesterday talking about WordPress and the Enterprise. He talks to the how and why of it’s emergence in the enterprise scene, but in the process makes a number of statements that very clearly explains the challenges we face as information security professionals. That, however, does not take away from the great points he makes around why it is a good enterprise platform.
Quick side note:
If you’re not familiar with Chris Lema, he’s perhaps one of the most engaging and insightful people you’ll meet and loves to write. WP Engine on the other hand is one of the premiere managed WordPress hosting providers in today’s market specializing in the ability to make your website grow wings, yes like Red Bull.
Of the various things I do at Sucuri, the one I am fondest of, is the ability to lead our incident / intrusion handling team. This is an unadvertised service that we provide enterprises. At a high-level we perform forensic analysis of the incident, outline the impacts of the compromise and perform offensive countermeasures to attacks if so required. It’s in this capacity that I have gained a unique perspective on this subject. I can attest to its arrival in the enterprise, and I’d argue that it’s no longer sneaking in – that was perhaps 2 years ago.
As technology has grown more and more accessible, it has simultaneously freed up the enterprise to operate more efficiently, and it was only a matter of time until your corporate IT team wasn’t quite as essential to get your website built.
While I agree on the reason for why it’s used, I strongly disagree with the scenarios he provides for how it gets integrated. Not because they are not true, but because they are.
In the last 12 months we have handled half a dozen incidents for large enterprises. When I say large, I’m talking organizations with NOC/SOC implementations and revenue in the $100 – $500 million range. In that process I would categorize WordPress in the Enterprise in the following categories:
- Integration within the Enterprise
- Subset within the Enterprise
- Complete isolation from the enterprise
You would think that one category would have a bigger impact than the other, and while they do, they don’t. In every situation, there was an equal amount of impact on the brand, but in almost all instances no-one had given that much thought. In each incident, it also came down to the same thing:
- The business unit defined the need
- The IT/SEC groups recommendations were ignored
- The IT/SEC groups were held accountable for the compromise
The similarities in each concerns me greatly, but unfortunately, it’s not something that is new. This has been the dilemma that has faced security professionals for decades. In our minds, no-one understands what it is we do, no one understands the impacts, well, until it’s too late that is.
They take it to the IT department who has no bandwidth for these “little” projects. And then some young, enterprising employee who is a non-programmer pulls a MacGyver – the decide they are going to make the project happen, and find the tools they understand how to work with, figure out what they can’t, and develop a solution.
To me, these problems are reminiscent of our antiquated approach to the implementation and governance of our enterprises. We have forgotten that our jobs are to enable, not deter. The only sure way is not to say “No”, but to collaborate with the different groups and find a compromise. The facts are that budget cuts and business pressures will always win so we have to get creative in the way we engage, but then again, this has been a reality we have been living with for a long time. Personally, I would prefer to have ownership of all facets of the enterprise before giving it up and getting blamed for it anyway. Let’s not be confused though, it’s not just about the IT/SEC entities, organizations and their respective leadership need to open their eyes and better understand the threats. The idea of allowing websites to be managed and sustained outside of your networks is absurd.
Bringing The Point Home
Here is the cliff note version of two recent WordPress incidents that we have addressed in the enterprise:
Just two weeks ago I was on the phone with the representative for the media group of a Division I university. As you might imagine, their WordPress website had been compromised. In my initial discussion I asked for points of contact with their system administrators. There response, “Yeah, this is effort is not supported by our IT group, but we have a guy in-house that knows how to log into wp-admin and get things done.”
In another incident, a large enterprise, under pressures by its business units, set up a cluster of servers on their network dedicated to the website for one of their major properties. The business unit was given full administrative rights, per their request, and against the advise of the IT group. The new “administrator” proceeded to give all its contributing authors administrative rights. A few months later the application was compromised with a shell that provided the attacker full access to the server. Yes, the same server that sat within the network. The analysis of of the incident showed that it occurred when a users account was compromised, yes one of the users with full administrative rights.
I am willing to bet, regardless of where you sit on the fence, no one wants to be a part of either scenario.
Thinking it Through
In each situation a number of things went wrong.
The biggest failure was the breakdown in communication, but let’s face it, this isn’t new. For years it has been an us versus them approach. Those business units just don’t understand us, and those security types only care about their mountain dews and cheerios. It’s the reality that we live in, and have been for a long time, but there are things that we can do to improve that.
- Stop with the idea that the other is too stupid to understand what the other is doing
- Refactor your policy frameworks – 500 pages is dumb and highly ineffective
- Remember what it was like to be forward thinking and nimble? Good, now apply it to your job
- Technology is evolving, learn to embrace that fact and come up with solutions
In my experience, rational people can live with not getting their way if they can engage in good intellectual debate; let’s open the lines of communication and maybe we can avoid the incidents I outlined above.
If you find yourself dealing with a website compromise and require immediate incident handling you can always send us a note at email@example.com.
[…] WordPress, the enterprise, and security » […]
Great post fellow Chileno.
I’m just going to post this all over every IT department in the tri-state area. PLEASE people!! IT folk, PLEASE work with your other business units. Business units, PLEASE work with your IT!!!
This was an excellent approach to the topic. I always hear (from people who have little or no experience with WordPress) that “WordPress isn’t secure and isn’t an enterprise application.” Well, have you taken it on as an enterprise project? No? Hmm.
As with any platform, if it’s not implemented properly, there are going to be issues. I think why there’s a perception that this is more prevalent with WordPress is because WordPress is so darn easy for an end-user to install and “use” (probably not properly, but use). That’s both the wonder and detriment of WordPress.
I agree, it’s ease of use is what has exploded it’s popularity amongst website owners and attacker alike. That coupled with the low cost of implementation and maintenance enables the things described above. Unfortunately, those are the same factors contributing to today’s compromises.
It is good to note that while I talk about WordPress here, there are a number of other areas within the IT / BU realm that this applies to.
Great article. I work on WordPress development team that serves as a third party vendor to enterprise media publishers. We struggled with some of these same issues which we resolved by opening a direct line of communication using instant messaging with IT / SEC. We are now able to resolve problems in minutes or hours which previously took days or weeks going through the business dept. channels.
That’s a very good idea!
Opening that line of communication probably did wonders to make both sides realize they are all after the same common goal.
Thanks for sharing.
I noticed that this FTSE trading system is open again for subscribers. Has anyone tried it ???