Security and the Content Management System

Marketers depend on their content management system (CMS) to manage and update website content without having to code in raw HTML. It’s a required tool for any enterprise marketing organization. Unfortunately, the CMS also often serves as a target for cybercriminals and hackers who want to deface your website, deploy malware in your network and steal sensitive information.

For example, in September, hackers discovered a zero-day vulnerability in “File Manager,” a popular WordPress plug-in, that enabled them to upload malicious files that would enable them to take over the site and incorporate it into a botnet. Millions of websites were probed and attacked, according to ZDNet. This September attack was just the tip of the iceberg, however. Security Boulevard cataloged eight WordPress plugins in May that attackers had recently targeted due to vulnerabilities they contained.

Since you’re reading this blog, I figure you probably already work with a CMS or have done so in the past. But, if you’re new to CMS solutions, HubSpot has put together this excellent and thorough CMS overview. So, instead of discussing the CMS itself, I’ll assume you’re already familiar with the concept.

Most of these tips pertain to securing a CMS that you’ve deployed on-site. If you’re like most companies, you’re probably using the open-source solution, WordPress, which has more than 60% market share, according to W3Techs. 

If you’re working with a CMS-as-a-Service solution like HubSpot’s, the vendor should take care of most of these security issues for you. Emphasis on “should” — don’t take security for granted. If you’re using a SaaS CRM, it’s important to have substantive conversations and objective reassurances about security with your vendor. Your website is the public’s primary gateway to your company. The CMS that manages it must be secure.

Update Update Update

WordPress and other CMS solutions generally release updates at least once a quarter, though, if a particularly dangerous vulnerability comes to light, they will quickly issue a patch to fix it. Constantly monitoring for updates to install is irritating, no doubt. But it’s even more irritating to suffer a serious security breach because hackers took advantage of a known vulnerability in your out-of-date CMS.

Many people who don’t update their CMS choose not to do so because their build has customized functionality that an update might break, but it’s not worth the risk. If you do have customizations, don’t make them directly to the core system, instead, keep them in separate program modules, if at all possible, because the core will be updated most frequently. Whatever you do, don’t trade functionality for security.

Take Care with Plugins and Themes

If you’re using WordPress, it’s a near certainty that you’re also using a number of plugins and themes, because they provide valuable functionality. They introduce a great deal of risk, however. Vulnerabilities in these plugins are responsible for the majority of successful attacks. 

To reduce your risk, start by cleaning up your plugins. The more plugins you have, the higher your risk, so, if you have plugins installed that you no longer use, uninstall them. 

Also, just as you must continuously check for updates to your core CMS, you need to do the same for plugins.  

Carefully research each plugin and theme you install. If you’re using WordPress, their site lists useful stats for all plugins in their directory. There’s a lot of valuable information in those stats. For example, if a plugin hasn’t been updated in over a year, that’s a warning sign that regular security updates aren’t occurring.

Scan your CMS and plugins for vulnerabilities

Don’t depend on developers to identify vulnerabilities. You should regularly scan both your CMS and plugins to identify weaknesses that attackers could exploit. HubSpot recommends Defender by WPMU DEV, but they have even more options in their list of recommended WordPress security scanners.

Protect Your Forms from SQL Injection Attacks

SQL injection is a form of attack in which hackers slip code into your database that, once executed, can do all kinds of horrible things. One of the most common ways they accomplish this is through forms. Instead of answering a question, they respond with code, which your form then dutifully saves in the database.

To prevent this kind of attack, set your forms so that they don’t accept special characters and require Captcha authentication before submission to weed out bots. 

Unauthorized login and overly permissive roles

If your passwords are weak, it won’t take long for a cracking algorithm to guess it via brute force. And if you keep the default username of “admin” for the site administrator, it makes it even easier for hackers to gain administrator access to your website. These basic steps can go a long way towards preventing brute-force attacks:

1. Require passwords that are at least 12 characters in length and use lowercase and uppercase letters, numbers, and special characters
2. Create a new username for the admin
3. Enforce two-factor authentication, especially for admin access
4. Don’t reuse passwords across multiple accounts

Overly permissive roles present similar issues. In some systems, administrator access is the default for every user. There’s absolutely no need for everyone to have that level of access. Instead, adhere to the principle of least privilege access -- give each user only the minimum amount of access they require to do their jobs.

The CMS is a powerful tool, but that also makes it a powerful vector for attack. If all the above sounds too complex for you or your team to handle, consider going with a trusted vendor who can provide a CMS as a service. They can take care of most of the security issues noted above, so you can concentrate on creating great content.

Need help or advice on your CMS? Contact us!