A DFIRerent View of Web CMS Breaches - Learning from Real Attacks to Build Real Defences

Web Content Management Systems (CMSs) like WordPress, Joomla, and Drupal are among the most common components of today’s web infrastructure—and a prime target for attackers. Despite the abundance of documentation on how to secure them, real-world breaches show that many organizations struggle to apply those best practices effectively.

In this session, we take a DFIRerent approach to CMS security. Instead of starting with theory, we’ll walk through real-life breach cases which we responded to (WordPress in both cases), where attackers successfully compromised the sites, achieved their actions on objectives, and left system administrators and defenders playing catch-up. We’ll highlight the attack paths and techniques we encountered in these breaches, the challenges we faced during the incident response process, and most importantly, how we translate these insights into actionable steps that you can apply to your own CMS environments within a day (or two).

These DFIR cases will never make it to the news—so do join us this evening if you are interested to hear more about them!