Yeah, it is.
So, we've talked about patching, we've talked about vulnerabilities,
the third way that we saw lots of people get owned
was having really bad passwords, or reusing passwords.
Like, you're a bit of an expert on password reuse.
Well,
I see a lot of it happen by virtue of running Have I Been
Pwned and seeing a lot of data breaches.
I know empirically based on the data I see how frequently the same
passwords appear over and over and over again.
But you know, it's kind of interesting because for the large part,
the data that I see is end user data, people come to websites,
they sign up for the cat forum or whatever it is,
the same password,
what you're saying here though is it's like system administrators.
It is,
but actually the more interesting thing is if you
look at many e-commerce websites,
there are two people who have got access to the content management system.
There's the system administrators,
so they've all got really super strong passwords because
they're system administrators-- well, the ones that are Pluralsight customers,
yeah,
and then there is the people in the marketing department whose
job it is to change how the website looks.
Content admins.
Content admins, yeah.
Content admins who would also often be putting JavaScript tags into the headers
because they've just done an advertising deal with somebody.
Now, pray tell, why do system administrators from a marketing department,
like, no offense to the marketing people here,
but I think you're saying like, non-technical people,
why do they need to put script tags in pages to serve content?
Because a company will come to them that says,
hey, we'd love to track your customers as they shop around the internet,
and then we will be able to --- This is sounding worse.
And this is how it works!
Then we'll be able to display advertising to them to
bring them back to your store, but we need to know what they were browsing.
You must have done that.
You must have been browsing on the internet for something and then two days
later you get an advert for the thing that you didn't buy.
Yeah,
I guess the bit that just like really touches the nerve is the
premise of non-technical people adding script,
which is active content, it can do all the sorts of things you showed,
which is obviously the problem here,
and they're just adding this arbitrarily into a page from
some third party who says I trust this, it'll be fine.
Yeah.
And in fact,
probably that third party line of script src= was
probably emailed to them as well.
Right.
So you can't just trust that.
So it's from a very nice secure channel.
And so the third thing for not getting your website owned,
that protect phase, is multifactor authentication.
Because although system admins might be really good at not doing password reuse,
people on the content management team might not be as good at that.
And we've seen lots and lots of, I mean,
some of these systems don't even have brute force lockout so that
you can actually just brute force --- Yeah,
just keep retrying.
So, I mean, that's like we know multi-step,
multi-factor, 2FA, whichever term we want to use,
is a fundamentally good practice.
And I guess the point you're making is that anything that can modify
content really needs to have that second control.
Absolutely.
And you know, when I started in the business,
the first time I put MFA in, it was RSA SecurID.
And I had to buy --- So it had a token.
--- I had to buy two servers that cost a fortune, right?
And I have to have a time sync to them, and you know,
it was a very expensive thing to do.
Now you can do it in three lines of code and use Google authenticators,
there's really not much of an excuse.
And if you are in the business of, you know,
if you're owning a Magenta site, there are companies,
and I'll just show you one of these,
there are companies that do 2FA just for Magento.
You know, that's their whole job.
So even if you're not that technical,
you can get 2FA and free for your content management system.
So it's just a matter of thinking about how you're going to get attacked,
the three attack vectors, vulnerabilities,
SQL injection, people doing brute force,
you know, guessing a password, and putting in some simple protections against it.