『Security for Non-Security People』のカバーアート

Security for Non-Security People

Security for Non-Security People

無料で聴く

ポッドキャストの詳細を見る
This year, host Bryan Mills has cleaned up multiple hacked WordPress sites, including one where a single outdated plugin handed the attacker a file manager: open any file, write straight to the database. Here's what the attacker knew about that organization before striking: nothing. A bot read a version number, and that was the whole crime.This episode is security with no dread and no jargon: four ordinary enemies, one afternoon of defenses, and a calm script for the bad day the defenses make unlikely. Bryan names the four attacks small sites actually face, brute force, malware through outdated software, AI-quality phishing, and form spam, and, just as usefully, the exotic threats you have permission to ignore. Then the baseline, nearly all of it free: the update schedule as the highest-value security control you hold, unique vaulted passwords, two-factor authentication on every account that could cause an incident, the one habit that defeats phishing even when the fake is perfect (never log in through a link in a message), and least privilege, including why publishing should never happen from an account that can delete the site. Then the walls and alarms, tuned rare enough to matter, and the hour-by-hour incident script with a tested backup at its center.On the Question Line: a board chair says, "We're a tiny nonprofit; nobody is going to bother hacking us," and we hand you the two-minute answer that wins the room. In the Tool Minute: Have I Been Pwned, the free breach check that makes the whole argument concrete in ninety seconds.Quick win: count your CMS administrator accounts, demote or delete the extras, and turn on 2FA for the rest.In This EpisodeThe four enemies: brute force, malware via update gaps, industrialized phishing, and form spam, plus the anatomy of a real small-site compromiseScope discipline as a security practice: the exotic threats to ignore, and the one setting that retires form spam for the yearThe baseline cost question: what would it cost to send the email that begins "We are writing to let you know about a security incident"?The phishing habit that survives perfect fakes, and the no-blame reporting norm that turns clicks into early warningsLeast privilege in practice: never fewer than two admins, no shared logins anywhere, and offboarding as a security eventWalls and alarms: two free layers, three settings, and the alert-fatigue tuning that keeps the rare message loudThe incident script: confirm, contain, rotate, restore onto an updated platform, and write the log entry that closes the loopMyth busted: "we're too small to be a target"The Question Line: the board chair's objection, answered in two minutes (send yours in via the link below)The Tool Minute: Have I Been PwnedLinksThis episode's worksheet, the Security Baseline Checklist and Incident Response One-Pager: https://webmanagers.com/registerEpisode page (full notes, worksheet, and transcript): https://webmanagers.com/podcast/security-for-non-security-peopleCapthca: Cap https://trycap.dev/ | hCapthca | Google reCAPTHCAHave I Been Pwned: haveibeenpwned.comThe book, Strategic Web Management: First Steps for the Accidental Web Manager: Companion site and all free worksheets: https://webmanagers.com/registerFollow the show: https://webmanagers.com/podcastLeave a rating and review: Apple Podcasts | Spotify URL | Other ChannelsAsk a question for a future episode: https://webmanagers.com/podcastTimestamps0:00 The bot that read a version number1:40 What this episode covers3:00 The Shift: automated, indiscriminate, and phishing without the tells4:50 The four enemies, and the threats you may ignore7:15 Anatomy of a small-site compromise8:25 The baseline: updates, credentials, 2FA, and the phishing habit10:55 Least privilege and the offboarding checklist12:10 Walls and alarms: two free layers, tuned rare14:25 The day you get hacked: the calm script17:25 Myth busted: "we're too small to be a target"18:25 The Question Line: the board chair's objection20:55 The Tool Minute: Have I Been Pwned22:10 Quick win: the administrator audit23:10 Worksheet and where to find it24:05 Close and Episode 10 tease
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません