However, easy to use and secure are certainly not synonyms when CMS are concerned. While most of the leading CMS don't require much effort to make them very secure, it is not uncommon to see CMS without the proper security. Such CMS are easy targets for hackers.
When a CMS gets hacked, usually the reason for this is not that the CMS itself is insecure but that hackers took advantage of some common admin mistakes. The list of admin mistakes is pretty long but not surprisingly, the number of the most common ones is a single digit. Here are some of these mistakes you must know and never do in the CMS you administer:
1. Default passwords
One of the first things hackers check when they plan to attack is for "easy passwords". Default passwords (i.e. the passwords that come together with the installation) are easy to find. It is true that many CMS don't come with a default password or even if they do, the installation procedure will make you change your password before you can use the software but if your CMS comes with a default password, make sure that you change it. Also, make sure that you change the password for the database as well because the database is also a target for hackers.
2. Blank passwords
In addition to default passwords, blank passwords are another common mistake admins make (if the CMS allows them because fortunately many CMS don't allow blank passwords). It is not necessary to state how risky blank passwords are - they require no guessing at all and hacking a CMS with a blank password is simply a piece of cake for a beginner. All it takes is to guess the username - if the username is "admin", "administrator" or something similar, then breaking into your CMS is a matter of seconds.
As with default passwords, the risk is higher when the admin account is affected but there is no reason to allow non-admin users, who have access to the database to have blank passwords. This is why it makes sense to force strict rules for passwords for everybody.
3. No patches installed
It is true that installing tens of patches a day is boring but if you don't watch out for (at least) the critical updates and don't install them in a timely manner, this is an invitation to hackers. Hackers monitor reports for new vulnerabilities and rely on the fact that the administrator won't install the patches immediately.
In fact, many hacks happen just in the time period between a vulnerability is reported and the admin installs the patch. This is why it is important to install patches fast and manually. Automatic install is easier but as strange as it might sound, it could make things worse - i.e. break your CMS. You do need to install patches manually, so that you know exactly what has been installed.
4. PHP register_globals on
If your CMS is written in PHP and you are using PHP 5 or earlier, one more thing you need to check right away is if register_globals is on. If register_globals is on, you must turn it off immediately because when it is on, there are millions of ways in which this can be misused to hack your site. For many CMS this variable is by default off but you can't rely on that - you need to check it manually.
In the rare case when you have plugins or other functionality that can't work when register_globals is off, it is a no brainer what to do - just get rid of these plugins/functionality because this is less of a sacrifice than having register_globals on.
5. Insecure web hosting
Insecure web hosting is one of the greatest danger for the security of your CMS. Vulnerabilities in the operating system and the other software that is installed on your web host are also among the favorite targets of hackers and the worst is that if your web host is insecure, there isn't much you as an admin of your CMS can do to counteract it. You can't fix the holes in the security of your web hosting provider and the only thing you can do is escape to a better web host.
6. Generous user privileges
There are hardly any admins (in their right mind), who will give admin privileges to ordinary users but there aren't that few admins, who are really generous when user privileges are concerned. One of the most important security rules is the least privilege rule - i.e. give users access only to those parts of the site they really need to have in order to do their jobs. One of the risks of generous user privileges is that the credentials can be used for internal hacking, which is not a smaller problem than external hack attacks.
7. Insecure plugins
Hackers might not enter through the front door of your CMS but if the other doors are open, they don't need backdoors (i.e. malware) to gain access to your site. Almost any CMS relies on plugins to provide additional functionality and this is the charm of CMS because you get a base installation and you have the freedom to add only the functionality you need but this freedom is also a security risk.
As a rule, plugins are developed by third-parties and it is not quite clear if they are rigorously tested. Very often plugins have security holes in them and hackers are happy to take advantage of any such security holes. The wisest you can do is remove any plugins with known security issues. It is much better not to have a particular functionality than to put the security of your whole site at risk.
genix, 17 April, 2010
the image in "PHP register_globals on" is wrong. The language on the pic is Javascript, better "JQuery", not PHP.