Lessons Learned by the WordPress Security Team
Cyber Security & Cloud Expo NA 2018
Aaron D. Campbell
@AaronCampbell
+
Our Goal
Keep WordPress Users Secure
Lesson 1:
Users Over Software
Users on Out of Date Versions of WordPress are Less Secure – What do we do?
Upgrade for them
Auto Updates
Should We Backport?
Will it help keep WordPress users secure?
↓
Yes?
↓
Backport it
Securing Users is Complex
WordPress % of Internet
Extrapolated Terribly to # Sites
| Year | Percent |
|---|
| 2011-02-01 | 13.1 |
|---|
| 2012-01-01 | 15.8 |
|---|
| 2013-01-01 | 17.4 |
|---|
| 2014-01-01 | 21 |
|---|
| 2015-01-01 | 23.3 |
|---|
| 2016-01-01 | 25.6 |
|---|
| 2017-01-01 | 27.3 |
|---|
| 2017-04-01 | 27.7 |
|---|
| 2017-07-01 | 28.3 |
|---|
| 2017-10-01 | 28.7 |
|---|
| 2018-01-01 | 29.2 |
|---|
| 2018-02-01 | 29.4 |
|---|
| 2018-03-01 | 29.9 |
|---|
| 2018-04-01 | 30.4 |
|---|
| 2018-05-01 | 30.7 |
|---|
| 2018-06-01 | 30.9 |
|---|
| 2018-07-01 | 31.1 |
|---|
| 2018-08-01 | 31.4 |
|---|
| 2018-09-01 | 31.7 |
|---|
| 2018-10-01 | 31.9 |
|---|
| 2018-11-01 | 32.2 |
|---|
| 2018-11-27 | 32.4 |
|---|
| Year | Sites |
|---|
| 2011-01-01 | 45326576.793 |
|---|
| 2012-01-01 | 110140139.262 |
|---|
| 2013-01-01 | 117099421.842 |
|---|
| 2014-01-01 | 203465315.13 |
|---|
| 2015-01-01 | 201103616.916 |
|---|
| 2016-01-01 | 267656910.848 |
|---|
| 2017-01-01 | 482370909.384 |
|---|
| 2018-07-01 | 590697181.35 |
|---|
| 2018-08-01 | 596395224.9 |
|---|
| 2018-09-01 | 602093268.45 |
|---|
| 2018-10-01 | 605891964.15 |
|---|
| 2018-11-01 | 611590007.7 |
|---|
| 2018-11-27 | 615388703.4 |
|---|
Lesson 2:
Reassess Regularly
Lesson 4:
Relationships are Important
