Security for Non-Security People

This year, host Bryan Mills has cleaned up multiple hacked WordPress sites, including one where a single outdated plugin handed the attacker a file manager: open any file, write straight to the database. Here's what the attacker knew about that organization before striking: nothing. A bot read a version number, and that was the whole crime.

This episode is security with no dread and no jargon: four ordinary enemies, one afternoon of defenses, and a calm script for the bad day the defenses make unlikely. Bryan names the four attacks small sites actually face, brute force, malware through outdated software, AI-quality phishing, and form spam, and, just as usefully, the exotic threats you have permission to ignore. Then the baseline, nearly all of it free: the update schedule as the highest-value security control you hold, unique vaulted passwords, two-factor authentication on every account that could cause an incident, the one habit that defeats phishing even when the fake is perfect (never log in through a link in a message), and least privilege, including why publishing should never happen from an account that can delete the site. Then the walls and alarms, tuned rare enough to matter, and the hour-by-hour incident script with a tested backup at its center.

On the Question Line: a board chair says, "We're a tiny nonprofit; nobody is going to bother hacking us," and we hand you the two-minute answer that wins the room. In the Tool Minute: Have I Been Pwned, the free breach check that makes the whole argument concrete in ninety seconds.

Quick win: count your CMS administrator accounts, demote or delete the extras, and turn on 2FA for the rest.

In This Episode

• The four enemies: brute force, malware via update gaps, industrialized phishing, and form spam, plus the anatomy of a real small-site compromise
• Scope discipline as a security practice: the exotic threats to ignore, and the one setting that retires form spam for the year
• The baseline cost question: what would it cost to send the email that begins "We are writing to let you know about a security incident"?
• The phishing habit that survives perfect fakes, and the no-blame reporting norm that turns clicks into early warnings
• Least privilege in practice: never fewer than two admins, no shared logins anywhere, and offboarding as a security event
• Walls and alarms: two free layers, three settings, and the alert-fatigue tuning that keeps the rare message loud
• The incident script: confirm, contain, rotate, restore onto an updated platform, and write the log entry that closes the loop
• Myth busted: "we're too small to be a target"
• The Question Line: the board chair's objection, answered in two minutes (send yours in via the link below)
• The Tool Minute: Have I Been Pwned

Links

• This episode's worksheet, the Security Baseline Checklist and Incident Response One-Pager: https://webmanagers.com/register
• Episode page (full notes, worksheet, and transcript): https://webmanagers.com/podcast/security-for-non-security-people
• Capthca: Cap https://trycap.dev/ | hCapthca | Google reCAPTHCA
• Have I Been Pwned: haveibeenpwned.com
• The book, Strategic Web Management: First Steps for the Accidental Web Manager:
• Companion site and all free worksheets: https://webmanagers.com/register
• Follow the show: https://webmanagers.com/podcast
• Leave a rating and review: Apple Podcasts | Spotify URL | Other Channels
• Ask a question for a future episode: https://webmanagers.com/podcast

Timestamps

• 0:00 The bot that read a version number
• 1:40 What this episode covers
• 3:00 The Shift: automated, indiscriminate, and phishing without the tells
• 4:50 The four enemies, and the threats you may ignore
• 7:15 Anatomy of a small-site compromise
• 8:25 The baseline: updates, credentials, 2FA, and the phishing habit
• 10:55 Least privilege and the offboarding checklist
• 12:10 Walls and alarms: two free layers, tuned rare
• 14:25 The day you get hacked: the calm script
• 17:25 Myth busted: "we're too small to be a target"
• 18:25 The Question Line: the board chair's objection
• 20:55 The Tool Minute: Have I Been Pwned
• 22:10 Quick win: the administrator audit
• 23:10 Worksheet and where to find it
• 24:05 Close and Episode 10 tease