CISA, which stands for Cybersecurity & Infrastructure Security Agency, is a US federal agency operating under the Department of Homeland Security. Established in 2018, it supersedes the NPPD – National Protection and Programs Directorate and is tasked with improving cybersecurity against attacks originating from both private and state-backed hackers.
CISA carries out much work to help ensure the safety and security of critical infrastructures and systems. To this end, it publishes several guides and lists to help government entities and private businesses maintain good security practices and stay safe online. You can just as easily apply CISA’s guides to your personal or business WordPress website for security that’s compliant with CISA’s standards.
One such resource that the CISA is making available to the public is its catalog of bad practices. While this catalog is a work in progress – and always will be due to the dynamic and evolving nature of threats – it gives us invaluable insight into what the CISA considers truly bad practices.
CISA and WordPress security
CISA’s bad practices are often prevalent in WordPress environments, making the list even more relevant to WordPress administrators and website owners. Fortunately, eliminating these bad practices is easy and can be done in no time at all.
If you’re looking to take your security to the next level, refer to the WordPress security guide for a complete and detailed list of all that you can do to ensure your website is secure.
The agency has also opened a GitHub page where administrators and other IT professionals can give their opinion about bad practices for inclusion in the catalog.
Risk 1: Using unsupported software
Invariably, software comes with bugs – which is one of the reasons why developers release updates. Updates not only address bugs and security holes but also add new features and improvements. Installing these updates as soon as possible is very important to keep your infrastructure secure.
Unsupported software, such as old versions, software that has reached its end of life, and nulled plugins, do not receive updates, making them especially dangerous since they can introduce known vulnerabilities to your environment.
Attackers can exploit these vulnerabilities to gain unauthorized access to your system. In turn, this allows them to steal your data, take your website down, and do a host of other malicious activities.
Solution
When picking plugins, look at the version history to see how often updates are released. Daily updates are not a good sign; however, so yearly updates may also indicate something is amiss. You might also want to check user comments to see how responsive the developer is to user questions.
Risk 2: Bad passwords
Bad passwords include default passwords, recycled passwords, passwords that have been previously leaked, and weak passwords. Bad passwords can be very easy to crack, providing attackers with an easy route to your systems. Password sharing is another bad practice that often occurs in WordPress environments and beyond. Shared passwords greatly increase the risk of passwords getting leaked and make it difficult to trace issues and hold the team accountable.
Solution
A strong WordPress password policy goes a long way in helping you kick bad passwords out the door. Melapress Login Security is a WordPress plugin that offers administrators granular control over how users set up their password policies, ensuring safe and effective passwords are used.
Risk 3: Single-factor authentication
Single-factor authentication is the third and final risk that makes it to CISA’s catalog of bad practices. In single-factor authentication setups, users can log in with just their username and password. In Two-Factor Authentication (2FA) or MFA environments, users must authenticate via a second (or more) method.
Single-factor authentication can be especially problematic if passwords are leaked, and while a good password policy goes a long way in minimizing risk, a secondary authentication factor greatly increases the overall security of your WordPress website.
2FA is fast becoming the golden standard for authentication. While its premise is quite simple, it can stop most of the most common attacks in their tracks. This makes it a favorite among industry giants, hobbyists, and everyone in between.
Solution
Installing updates as soon as possible can significantly minimize the risk associated with security holes and bugs. Equally, you want to ensure that the suppliers and developers you pick are responsive and issue updates frequently (and not once a year).
WordPress does not offer 2FA right out of the box. However, implementing 2FA on your WordPress website is easy, thanks to WP 2FA. This WordPress 2FA plugin comes with more options than you can shake a stick at, ensuring all your users can take advantage of 2FA for a more secure WordPress.
A WordPress security action plan to put bad practices to bed
Bad practices are like bad habits. They must be kept in check over time to ensure nothing falls through the cracks. This is why WordPress security is an iterative process; one we must attend to every so often to ensure that we are following best practices at all times.
While there are undoubtedly other bad practices that did not make CISA’s list, what they offer is a good starting point. To recap,
- Install updates as soon as they become available. If you are worried about updates breaking your site, install a staging environment to test the updates before rolling them out to the live environment.
- Implement a strong WordPress password policy using Melapress Login Security to weed out weak passwords from your environment. Encourage users to use a password manager to mitigate support calls for forgotten passwords that are too complex.
- Enable and use policies to require WordPress two-factor authentication on all users. Use WP 2FA to leverage its many features, which include Authy integration, grace periods, and white labeling, among many others.
While CISA’s list makes a good starting point, securing your WordPress website requires a more comprehensive approach. From ensuring strong passwords to hardening WordPress, there is a lot that you can do yourself by following Melapress’ guides for excellent WordPress security.
P.S. We recommend setting up a WordPress test environment if you have limited experience securing WordPress websites.
