Question #1: What is the legal responsibility for not securing their site and they get hacked? Would be nice to explain to clients 2 convince
Answer:The legal ramifications depend on your industry and country of origin. There currently isn’t a USA-specific law to the compromise of a website, but there are a number (depending on your state) on the breaches that revolve around personal information. A good resource for the breach notification laws you can reference this article for the latest statues by state.
If you’re an ecommerce website, while you don’t have legal responsibility, you do have to comply with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS was formed in 2006 in collaboration with the major credit card brands (e.g., Visa, MasterCard, Discover, JCB and American Express). The latest guidance can be found in version 3.1; the new version, 3.2, is expected to be released April 2016.
Question #2: Could something be written that would infect the hacker, so they would not want to touch your site!
Answer: It is always possible, but you walk a very delicate line and it may be illegal to do so. The attacker might be proxying through networks, which may lead you to attack another one of his victims.
Question #3: Are there any hosting providers that you recommend?
Answer: The hosting market is highly competitive and you have very good options out there. We would need more information on the requirements to give a better answer. If you are technical and can manage your own server, you have many options from Amazon AWS, Google Compute Engine, OVH, Linode, Digital Ocean, etc. If you prefer someone to manage your server for you, look at anaged platforms, which there are also many available. If your site and budget is small,you can also look at shared hosts, which start at a much lower price. Before we can help much more, you have to look at your budget, the time you want to spend managing the site/server and the latform your site is on. Once you have that in mind, the decision on where to host becomes a lot easier.
Question #4: Do we must use CloudProxy or we can also use something like Cloudflare and still get max protection?
Answer: Sucuri’s Firewall (aka CloudProxy) provides a complete security solution with a CDN on top of it. So you do not need CloudFlare on top of our Firewall, but if you still want to use both, we are compatible and a few of our clients do use both for a variety of reasons.
Question #5: What is the difference between @sucurisecurity and @wordfence?
Answer: Wordfence is a great application-level security utility plugin for the WordPress platform. Sucuri is a global Software as a Service (SaaS) technology that sits at the edge, beyond the application. Sucuri is also platform agnostic, allowing it to work in any open / closed source environment. Sucuri supports all platforms, including, but not limited to: Custom Site, WordPress, Joomla!, Magento, osCommerce, vBulletin, Drupal, .NET.
Question #6: Will @sucurisecurity come to Drupal CMS?
Answer: Sucuri already supports the Drupal CMS on all of our products. 🙂 Please ping us at info@sucuri.net and we’ll provide more information.
Question #7: Many clients don’t always understand what a SSL is and is not. May be useful to explain.
Answer: Secure Socket Layer (SSL) is now a deprecated encryption protocol that has been replaced with Transport Layer Security (TLS) version 1.1 and higher. It was however the encryption protocol that supported the HTTPS protocol for close to 30 years, as such, SSL is used interchangeably with TLS. The “SSL” protocol secures data in transit, between browser and web server; it does nothing for the security of the website itself I’m sharing an article in which I go into more details that should help address your concern.
Question #8: Why should we use your hosted DNS vs just changing the a records?
Answer: Our hosted DNS is configured on an Anycast network, providing reliability, speed, and performance. Additionally, it’s part of our complete security stack. It provides our team the flexibility in the event of a security incident that requires traffic to be rerouted for any reason.
Question #9: You going to be releasing a Joomla extension like you do for WordPress?
Answer: Not currently on the roadmap.
Question #10: Do you offer pen testing
Answer: We do offer custom services for pentesting, but it’s determined on a case-by-case basis
Question #11: One of our sites received a defacement while under CloudProxy. Why?
Answer: This is not easy to answer without more context. There could be a number of reasons, the most prevalent is a concept known as cross-site contamination. We wrote an article on the subject a few years that might help understand what happened. The other possibility is always around authentication / authorization. CloudProxy is designed to stop external attacks, but if something like username / passwords are compromised there is little it can do if the admin panels are open to the world. Here is an article I wrote on access control that you might find helpful. Again though, without more information on the specific case it’s hard to give you a good answer. If you can send us the details, we’d love to investigate and see if we can’t provide a better answer.
Question #12: Do you offer pen testing
Answer: The best way to stay current with the latest issues is to subscribe to our Blog. We pride ourselves in staying ahead of the latest and emerging threats. There are specific outlets depending on your platform, but you should always subscribe to the CMS and extensions you’re leveraging.
Question #13: Can I use a backup to fix my hacked site?
Answer: You can use a backup to restore a hacked website, but it doesn’t necessarily do much for you in the realm of “fixing.” Fixing is something that would be accomplished by identifying the attack vector, and patching it. A backup just kicks the proverbial can down the road, bound to be an issue again sooner or later.
Question #14: Do you offer pen testing
Answer: Your host handles the security of the server and their network, not of your website. I wrote a pretty extensive article on the subject that you might find insightful. Some hosts do leverage things like ModSecurity and put forward good effort in proactively defending attacks Security however is often not their core focus, and their proactiveness is limited to their resources, often finding themselves being more reactive to disclosures.
Question #15: Why do website reinfections happen?
Answer: Website reinfections happen for a number of reasons. The most common reason is that you likely removed the malware, but did not patch the original vulnerability that allowed the site to be hacked in the first place. Second, attackers might have left backdoors that were used to reinfect the site. That was actually the reason why we built our Sucuri Firewall (CloudProxy) initially, to protect sites against reinfections by virtually patching vulnerabilities and blocking backdoors. It could also be related to cross-site contamination. The harsh reality is that reinfections happen because website owners rarely take the time to apply the necessary changes post-compromise. Whether that’s patching identified vulnerabilities, hardening specific sections of the websites or the basics of updating all user credentials.
Question #16: How do we get one of those cool shirts?
Answer: Which ones? The polo? Send an email to marketing@sucuri.net , let’s see what they can do.. 🙂
Question #17: Lower pricing for eastern europe small agencies? 🙂
Answer: Have you already engaged with our Sales Consultant team? We work very hard to make the pricing affordable, but as you might imagine localizing is always going to be a challenge. I am sure however with enough volume the team would work really hard to make something work. 🙂
Question #18: Our site was developed with quite a bit of custom coding and plugins (WordPress) which break upon WordPress updates, unless manually patched – which can be time consuming. How can we protect our site between WordPress security alerts/releases and the time it takes our web development to apply patches on custom code and plugins?
Answer: Honestly, the easiest approach would be to leverage something like Website Application Firewall (WAF) / Intrusion Prevention System (IPS). Something like the Sucuri Firewall (a.k.a CloudProxy) . It’s honestly the most effective approach to working in an environment such as the one you described. Other alternatives include deploying your own, via technologies likeModSecurity and others.
Question #19: I am very curious about what sort of security is offered by website builders like Squarespace, Wix, Weebly, etc. Especially in the context of selling my WordPress dev services against those options. What would you say? My typical customer wants to keep things simple and their eyes dart everywhere when I start to tell them about security concerns and the need to be proactive and vigilant. They want to trust Weebly et al and think it will be simpler for them.
Answer: The biggest thing these closed environments offer is that they maintain a highly locked down environment. They take away a lot of the risk that today’s CMS introduce, specifically those that revolve around how much access and flexibility an end user has. While I’m a big fan of the open-source community, I can definitely see how these closed-environments offer a better solution for some business owners. I don’t work with any of them, but from what I see they offer a great solution for website owners, especially when it comes to security.
Question #20: Is WordPress the most vulnerable CMS? (vs joomla and drupal)
Answer: Not sure how to answer this question. All CMS applications have vulnerabilities, WordPress is larger so it’s a more attractive target. More bang for your buck.
With that in mind, it’s not that WordPress is more vulnerable but that their market is much bigger. Today’s issues rarely revolve around issues within the core of the CMS, but rather it’s extensible components (i.e., plugins, themes, etc..).
The same is true however for all other CMS applications.Their market is bigger, so I’d say there are more issues in the ecosystem but proportionally it makes sense.
Question #21: Will the slide deck be something we can share with our own customers to help explain why they need security?
Answer: Of course, that’s why we’re preparing it. Both the slide deck and video are things we want everyone to share and consume.
Question #22: Is there a way to have the quality of my website code “”audited”” to know more about vulnerability and ease of fixing?
Answer: There are a few services out there that offer different forms of auditing, but they can be expensive. If you have something specific you want reviewed, send us the case to info@sucuri.net and we’ll see if it makes sense within our review services or if there is something else you can leverage. Be clear though that reviews are not inexpensive. They require a budget of some kind -whether to leverage a tool to do the reviews, or pay someone to make the fixes. Investing in a vulnerability management program is not for the faint of heart.
Question #23: Does Installing Google Tag Manager Compromise Server/website Security?
Answer: We have to look at security holistically. Anything you add into your environment that allows someone to circumvent an existing security control is something worth identifying as a potential issue. With that in mind, if you have a tag manager pixel on your site and someone can inject code into your website, I’d say that’s a concern. You’ve now extended your perimeter to an environment you can’t control. Google or not. It’s a new access point. We don’t use it for this exact reason
Question #24: Should I have my domains under private registration with my registerer?
Answer: If you have a business website, it is best to register under your company name and address. Use a generic role ( admin@domain.com or tech@domain.com ) instead of someone’s name. For a personal site, private registration is easier and safer, as you wouldn’t want to leak your personal address or phone number.
Question #25: How difficult is it to install / activate subscription securi? I have very little technical ability and worry if I will be able to handle it.
Answer: We find it fairly straightforward, but that is of course very relative. Good news though, if you need someone, our team is available to help. All we need to do is communicate the problem. 🙂
Question #26: Can you please elaborate on how these hackers scan for vulnerable websites? When a client gets hacked, they always ask “why me?”. They feel that they were specifically targeted.
Answer: So in the future, you can point your clients to this article I wrote, in it I speak specifically to this. Additionally, youcan point them to this article in which I talk specifically to automation and how that is the makeup of most of today’s attacks.
Question #27: When downloading a JQuery script how do I know if it’s safe to use?
Answer: I would recommend to always stick to to the official repository provided by JQuery.
Question #28: Are there any wordpress plugins that you know to be highly compromised (or can be easily compromised) that you would recommend users stay away from?
Answer: Oh my, this is a big question. If we knew they were highly compromised, they wouldn’t be anymore.. 🙂 I’d recommend subscribing to the WPScan Vulnerability Database to stay abreast of the latest vulnerabilities.
Question #29: Why isn’t possible to build an anti-virus/anti-malware software to protect the website, similar to what is done for local environments, like Windows? Will this happen in the future?
Answer: Windows doesn’t have one AntiVirus / AntiMalware solution, they have dozens of vendors. There is no such thing as a “silver bullet” which is what is being asked here. Everyone does things a little differently than the other, which leads to different success rates. But there is no single solution for Windows, or any other system. It’s unlikely this will ever happen for the desktop or for websites. The environments are too complex.
Question #30: How well does Sucuri “”play”” with CloudFlare?
Answer: Sucuri Firewall integrates perfectly with CloudFlare. Most users don’t have to leverage CloudFlare once in our environment, as our technology offers them a CDN with performance improvements as well
Question #31: How do I make sure all my client web site are (most of them using wordpress) are secure? DO you have any tool that crawl server?
Answer: You should really considering deploying the Sucuri Firewall on each of them. Instead of crawling and looking for vulnerabilities then patching, leverage the solution to virtually patch and harden the environments.
Question #32: Is there a standard set of plugins or suggested setup actions sucuri would recommend for any WP site?
Answer: From a security perspective they should leverage the Free Sucuri Security plugin for WordPress. I would also recommend they enable 2FA on the login panel, and think seriously about employing some form of WAF/IPS solution.
Question #33: I find any OLD dbase website is at risk and gets hacked almost 100% of the time whereas some of thehtml sites never seem to be hacked
Answer: Well if it’s an old database (depending on how it’s maintained) it’s likely a SQLi issue. It sounds though that the issue is exploitation of vulnerabilities within those environments. The threat landscape for a static html website and a website that uses a database is very different.
Question #34: Is there a training webinar that goes into detail on all the settings in the Firewall dashboard?
Answer: Not yet, but it’s coming. 🙂
Question #35:I have the Sucuri cloudproxy firewall running on several WordPress sites. I don’t have the budget to run the full sucuri Monitoring/Clean-Up service. If I find one of my sites victim to attack, would I still be able to employ your clean-up services after the fact?
Answer: Sounds like you might want to look at our Agency configuration where you can subscribe to have ad-hoc cleanup fees
Question #36: Joomla has documentation that suggests cleanup through a fresh installation & re-installing extensions, then copying site data into the new site’s database. Is there a way to analyze or check a database for exploits?
Answer: Yeah, that’s always the trickiest bit. There is no all-encompassing script for all variations. In situations like this I’d recommend having a professional service go through the database where they can employ their toolsets. You won’t really find those freely available unfortunately
Question #37: If we follow the recognized guidelines for user responsible security measures, re: changing passwords, etc. and we use Sucuri, how safe are we? If the owner does their bit and Sucuri does their bit, can we ever really feel safe?
Answer: Security is a continuous process, not a static state. If everyone does their part, I would say that their confidence level should be very high that they are secure. They of course will never be 100%. It’s just not a reality in the world of security. They will be able to sleep good at night though. 🙂
Question #38: Does it help to implement httpS on the entire site?
Answer: If you are implementing HTTPS, you have to implement it on the whole site. A partial HTTPS implementation saves you very little in terms of resources and opens the doors to downgrade attacks.
Question #39: Are there some plugins that we should stay away from ? or beware of
Answer: Please reference question #30 – subscribe to WPScan Vulnerability Database.
Question #40: Do you feel like its worth the effort to change the wp-admin login URL? Once you realize a page is wordpress, you can get to the gate pretty easy when the user login in a default www.website.com/wp-admin. Thoughts?
Answer: We don’t feel it is worth it to change the wp-login URL, because we actually recommend everyone to lock it down only to allowlist IP addresses. Our Sucuri Firewall will do that by default and restrict access to wp-admin, wp-login and other popular CMS login pages only to allowlisted IP addresses.
Question #41: A website visitor recently told us that his workplace firewall has been blocking our site, listing it as pornography or gambling. What can a website owner do to fix this issue?
Answer: It sounds like a misclassification of the website. These can be tricky. The best course of action is to identify what the warning is and who the provider is. You’ll then need to navigate the process, identifying the right group for the provider to see how to go about getting reclassified. Often it’d be done by the networks NOC / SOC team.
Question #42: I would love a webinar, geared to those working in the website security field, on how to fix a site when hacked. We manage 85+ WP sites on a monthly basis.
Answer: Cool, will look into it
Question #43: We had a joomla and a wordpress website defaced at the same time on the same shared server… The wordpress website was behind the sucuri WAF but not the Joomla website… can this indicate deeper vulnerabilities at the server level? do you have any server side security services?
Answer: Actually, what this is likely due to is a contamination event. I wouldn’t jump the gun and say it’s a server-level issue. I’d first work to make sure all websites on the same server are treated the same way. If you protect one, protect them both. If you don’t care about one, remove it off the server. That’s where I would start.
Question #44: We were hacked (backdoor installed), we’ve cleaned up the server, but how can we fully understand HOW we were hacked? Does Sucuri offer any services that can help with the identification of how a previous hack occurred/what was exploited?
Answer: Possibly, but it would depend on the data available. Often the issue is not knowing how to get the answer, but the data available to do the forensics. If you want more information, you can engage us via sales@sucuri.net and we’ll work to see if we can help.
Question #45: Hi, Is it possible to block anybody from accessing the wp admin except if they log in from a specific country, ie South Africa ?
Answer: Oh yes, you’re talking about Geo blocking. We actually recommend being more paranoid and blocking everyone except if they come from an authorized IP address. Our Sucuri Firewall allows you to do that easily (country blocking & IP address restrictions)
Question #46: One of the big emerging threats is Ransomware, such as the Linux Encoder malware. Does Sucuri protect from this type of attack and How does Sucuri keep up with protection from this type of attack on an ongoing basis?
Answer: Ransomware has been around for a long time. It’s only now resurfacing and taking center stage. I wrote about thepotential for ransomware affecting websites in 2012. In 2016 we wrote about how we had started seeing it affect websites specifically. So there are a couple of things happening here. First there is the effect of ransomware on websites, then there is affect of ransomware being distributed via websites and affecting local environments. To your specific question on Linux.Encoder malware, a lot of those attacks are occurring through the exploitation of software vulnerabilities in websites. So yes, we’d be able to mitigate these attacks via our SaaS based WAF / IPS technology. If the attacker uses a different means of attack, say they exploit a vulnerability in the servers software, then that’d be a different discussion.
Question #47: How does the layer of security provided by Sucuri impact the performance of the website insofar as the website visitor is concerned.
Answer: It improves your performance and speeds up the load time for your visitors. So it has a positive impact to your performance.
Question #48: I use Htpasswd to protect my admin directory for wordpress. I also use a plugin called limit login attempts. That seems to work for me what do you think?
Answer: Great start. It won’t help you against software vulnerabilities, but does protect you against brute force attempts.
Question #49: One of our website got hacked in in 2 days once it was released. No person or any search engines knew the website URL. How did it happen?
Answer: I have no idea, I’d need more information like the logs and details of the compromise to give you a more definitive answer.
Question #50: How can a mere mortal ever get on top of all this?
Answer: The honest answer is to employ the help of professionals. There is a reason there are subject matter experts in every field. From developers to designers to hosts to system administrators, security is no different. I can change the oil in my car, but I’m not very good at it and if I want it to last I take it to the mechanic. When it comes to this stuff, I’d employ the help of organizations like Sucuri to be there and have your back when you need it most.
Question #51: Do you offer services to change web configurations on IIS? For example, I need to have TLS 1.2 turned off on my web server. Can I hire you to do it?
Answer: Sorry, no we won’t do that kind of consultative service.
Question #52: Can you be hired to implement the sucuri WAF for my server?
Answer: Definitely, please ping our sales team sales@sucuri.net and we’ll be happy to engage you on your deployment.
Question #53: What are the 3 top must-dos to secure your WordPress website?
Answer: I personally stay away from 3 must-dos because they are the wrong mindset. I always tell people to think about how people log in, how you account for security vulnerabilities, and what do you do in the event of a compromise. Thinking in this way helps you determine what you should be doing.
Question #54: If the WAF can fully protect my site while the plugins and coding are being patched, why do I need to devote time to updating the plugins at all?
Answer: It’s generally best practice to keep everything up to date. While WAF / IPS technologies can be highly effective, it’s always about risk management. There are no 100% solutions, it’s all the things you do combined that improve your overall security posture.
Question #55: Can you tell us about WPScan project?
Answer: It’s a great black box penetration testing toolset designed for WordPress. It’s great for testing your environment to identify potential weaknesses in either access control or known vulnerabilities. I’d encourage you to give it a try. We wrote a multi-part series on our blog, I’d check it out.
Question #56: Can hackers do a group attack where they are targeting a group of people with the same wordpress settings and executing the same malicious actions?
Answer: Yes, this is often what happens when we speak of automated attacks. Assume for instance an attacker (or group) wants to target all WordPress users on version 2.0. The tools are updated to target that specific configuration. The same can be seen in plugins. Great examples of this was TimThumb in 2011, still relevant today, and Revslider in 2014 / 2015 (still relevant today).
Question #57: Is there a way for my web development team to identify which plugins are vulnerable, pirated, or not actively being used?
Answer: Having a vulnerability management program is important. There are different types of reviews you can do which include things like static and dynamic code analysis, as well as peer reviews. There are some tools you can leverage, but not all developers are the same. Builders and breakers think very differently. It’s not as simple as looking at a piece of code and saying that’s a vulnerability. Sometimes it’s daisy chaining a number of issues to create a security vulnerability. There are a few different vulnerability scanning tools, but it really comes down to what you’re trying to achieve. I would recommend doing some research online.
Question #58: ICan you explain how hackers execute brute force attacks on your login and password?
Answer: This is a very big question, which is why we’ve written a series of articles talking to Brute Force attacks. I’d recommend spending some time going through those articles to gain a better understanding of how Brute Force works. The short answer is that bad actors are able to pass a series of username / password combinations to your CMS administrator panel. They compile a large list of both values and try every combination until they find the right combination. It’s not the quickest, but it can be the most effective. Some amplification techniques allow them to be much more effective.
Question #59: Does regular updates to the WordPress plug-ins and themes the best way to prevent malicious code injections?
Answer: It honestly depends on what you’re doing with your site. I don’t recommend it for all websites.
Question #60: Would you recommend https for all sites?
Answer: It honestly depends on what you’re doing with your site. I don’t recommend it for all websites.
Question #61: Does regular updates to the WordPress plug-ins and themes the best way to prevent malicious code injections?
Answer: Regular updates to plugins and themes will keep the environment current, fixing bugs that may include securityissues. If you’re looking for a preventive solution though, you’ll want to start placing your focus on technologies like Website Application Firewalls (WAF) and Intrusion Prevention Systems (IPS)
Question #62: Can you explain quarantine? i see a quarantine directory on the server – do i keep that dir or delete it? or is it actually still being used?
Answer: I assume you’re referring to the quarantine folder we create on your server post-cleanup. If you can confirm that the site is fully operational, then yes, you should be able to remove it. That folder is there for our team to reference in the event something goes terribly wrong. We take snapshots of every file we touch and save it just in case
Question #63: CIf someone was to approach security from a DIY perspective, what are three things that every website owner should prioritize in terms of security?
Answer: When working with website security I always recommend you focus on: Access Control, Software Vulnerabilities, and Backups.
Question #64:I have a website that has nothing on it. Why do people try to break into a website with nothing on it? What are they trying to get?
Answer: I’d encourage you to read this article on Why Websites Get Hacked. It addresses your question directly. It’s not about what they are trying to get, as much as what they might be trying to do. Remember that it’s rarely a personal thing, it’s just luck of the draw. You were an easy target, and the automated systems picked it up as a target. Read more for more insight.
Question #65:Where can I register or look for the next webinars in this series?
Answer: Great question! Right now as long as you registered for this first one you’ll continue to get notifications of future ones.
Question #66: If my site is hacked can the hackers get into my computer and take files (images)?
Answer: If your website is hacked, and by computer you mean the web server, then of course. If by computer you mean your local desktop / notebook, then it just depends on what the attacker does on the website. If they’re able to install something locally to your machine, then possibly. It just depends.
Question #67: Is there a way to determine whether or not a plugin is actually being used in a site? Like a plugin audit? Other than deactivating each one by one and seeing what breaks…
Answer: If your website is hacked, and by computer you mean the web server, then of course. If by computer you mean your local desktop / notebook, then it just depends on what the attacker does on the website. If they’re able to install something locally to your machine, then possibly. It just depends.
Question #68: Do you recommend one WordPress host over another? I realize that the host isn’t responsible for the actual website security, but the host is a part of the whole equation. I’m looking for a good partner I can rely on.
Answer: Unfortunately, reliability in hosts is very subjective. My recommendation, if you’re looking for a managed environment, would be WPEngine or if you’re looking for a different kind of host, SiteGround. This is not to say the others are not good, these are just the ones I have personal relationships with.
Question #69: My website was hacked on 4 separate occasions. These attacks happened within hours of a spat in an estate battle. what are the chances that this was my siblings?
Answer: I couldn’t even begin to speculate. Sorry.
