Cybersecurity: Is your CMS a risk to your business?

Software development has changed beyond recognition over the last few decades. The rise of open-source software (OSS), distributed systems and hybrid cloud architectures combine to create complex, multi-layered ecosystems within every business. Protecting these ecosystems against cyberthreats is challenging.  

Security needs to be built in at every level and constantly updated to match the threat landscape. 

Challenges of OSS 

OSS comprises a large part of most modern software. It brings cost-savings, innovation, flexibility. And risk. 

OSS developers range from unpaid enthusiasts to teams in high-tech conglomerates. Some follow security best practices, others don’t. Developers move on, leaving products unsupported. The lines of responsibility for managing and maintaining code (including security updates) are often blurred. 

It’s not just OSS 

Any part of a supply chain can introduce risk, as demonstrated by the SolarWinds Orion attack.

Bespoke developments too are vulnerable if developers don’t adhere to best practices. Software reuse is a common practice, but code often becomes deeply embedded within applications, making maintenance hard. Software documentation may be incomplete or out-of-date.

The CMS risks

Many companies use an open-source CMS, such as Drupal, Joomla, WordPress or Umbraco.

And most enhance their CMS with plugins, 3^rd party products, bespoke extensions and integrations to other business critical systems – expanding their attack surface. Customer-facing portals present additional security risks around identity-related attacks – another aspect to consider if the portals are created using the CMS.

Cybercriminals focus their efforts on websites using components with known vulnerabilities. Zero-day attacks get publicity, but many websites are breached through years-old flaws that businesses failed to patch.

Businesses struggle to keep their CMS ecosystems up-to-date. Updates require analysis, regression testing, changes to other systems. And do you even know if you’re using a particular version of an obscure open-source library that needs patching?

A CMS often has many users, including content creators, managers, developers, IT support. A lack of suitable identity, authentication and access controls can open the door to hackers.