At WordCamp Europe 2015 , Matt Mullenweg named Nikolay Bachiyski the first Security Czar for the WordPress project . With over 10 years of experience contributing to the WordPress project, Nikolay is a great fit and has embraced the role. I had the opportunity to chat with him about this new role and his thoughts on current security trends and best practices.
What’s the focus of your new role as Security Czar?
My responsibilities are to coordinate the security efforts of WordPress.org – a lot of it is incident response – making sure we respond quickly, have solid fixes, and everybody involved is informed.
How does security reporting work within WordPress.org?
Anyone can report security issues. We have an email address to where people can send reports (we always appreciate security reports at security@wordpress.org — even if you’re not sure, we’re happy to check it out). Thankfully, most issues are not reported publicly as there are a lot of nice people who take the time and effort to report security issues privately.
We have a security team of trusted people who have the technical and communication skills to deal with most issues. The group has worked together well in the past, but I’m here to help make everything a bit more organized and streamlined. Everyone in the group is really smart and talented, but during hectic moments, sometimes communication can drop off and it becomes hard to know what has been done, what remains to be done, and who is doing what. Overall, these communication issues can be challenging.
We also have relationships with the bigger hosts and plugin authors, so they can help us test fixes to make sure we don’t break users’ websites with security updates.
What changes do you hope to implement in how the WordPress community responds to security concerns?
There aren’t any big changes planned. We’re mainly concerned with streamlining the internal processes already in place — making sure all of the issues go through the same process and that we have everything covered for each issue.
What are some tips you can offer for securing a WordPress site?
Always complete updates as soon as you can and make sure to use strong passwords. Those two steps go a long way in keeping your site safe. If possible, I recommend enabling auto-updates. Also, when choosing plugins, check to make sure you are using a plugin that is regularly updated! You can confirm this by checking the changelog for a plugin.
As an example, here’s the changelog for VaultPress .
How have security threats evolved over time? Is the internet safer or less safe now?
These days, the public pays a lot more attention to security issues. In the late 90s, I remember that it was so easy to hack into websites. Generally, I would say security measures and efforts have gotten much better over time. Of course, the people who are trying to break things or coordinate attacks are also getting more sophisticated, very often merging more than one attack. Here’s an example.
That said, it’s much easier today to cover most of the common problems. And with the increasing importance of software in our world, security problems are only getting more critical as well since the impact is higher. As a result, the average security level is higher because people care about security a lot more. Today, security is something you incorporate throughout the software building process rather than something you might add at the end.
Put simply: security threats grow in complexity and importance as software does.
How did you discover your knack for all things security? Are there any resources you’d like to share with someone who wants to learn more about the kind of work you do?
At some point in college, I went to a network security course. The interesting thing about security is that in order to build secure software, you have to think like an attacker. To think like an attacker, you need a strong understanding of how everything works. I guess I was just curious and, over time, security became a big part of writing software for me.
As for resources, I’d recommend checking out WordPress.tv security presentations and OWASP (Open Web Application Security Project).
On that note, if you want to learn more about Nikolay and his security work check out his recent WordPress Security Presentation on WordPress.tv:
