Lessons Learned by the WordPress Security Team

BSides Las Vegas 2018

 

Aaron D. Campbell

GoDaddy

+

WordPress

Aaron Black Hat
Top Secret

Our Goal

 

Keep WordPress Users Secure

Lesson 1:

Users Over Software

Users on Out of Date Versions of WordPress are Less Secure – What do we do?

Upgrade for them

Auto Updates

Should We Backport?

Will it help keep WordPress users secure?

Yes?

Backport it

Securing Users is Complex

Educate Users

Lesson 1b:

Educating Users is Hard

But Important

15 Years of WordPress

WordPress % of Internet

Extrapolated Terribly to # Sites

YearPercent
2011-02-0113.1
2012-02-0115.8
2013-02-0117.4
2014-02-0121
2015-02-0123.3
2016-02-0125.6
2017-02-0127.3
2017-05-0127.7
2017-08-0128.3
2017-11-0128.7
2018-02-0129.2
2018-03-0129.4
2018-04-0129.9
2018-05-0130.4
2018-06-0130.7
2018-07-0130.9
2018-08-0131.1
2018-08-3031.4
YearSites
2011-02-0145326576.793
2012-02-01110140139.262
2013-02-01117099421.842
2014-02-01203465315.13
2015-02-01201103616.916
2016-02-01267656910.848
2017-02-01482370909.384
2018-08-30596395224.9

Lesson 2:

Reassess Regularly

Volunteer Security Team

Can you even do this?

Lesson 3:

Volunteers are Hard

How Do We Make a Volunteer Team Work?

Hybrid

Mostly Volunteer

Tools

  • Slack
  • Trac
  • HackerOne

Lesson 4:

Tools Don’t Fix Most Problems

Lesson 5:

Relationships are Important

Q & A

Aaron D. Campbell – @AaronCampbell
GoDaddy

Slides: http://adcwp.me/bsideslv2018

This presentation is running on WordPress using the Presenter plugin