Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint most likely).

Is it true that our intranet would still possess security vulnerabilities even though it is restricted to internal staff?

share|improve this question
I smell that this question is about how dangerous a vulnerable CMS is on the intranet versus Internet? – Henning Klevjer Dec 7 '12 at 8:47
1  
that is exactly right – novicePrgrmr Dec 7 '12 at 9:06
If possible, I'd run WordPress as an isolated service or inside a VM with no outgoing access to the internal network. If you need LDAP to use users from Active Directory, then I'd allow that, but nothing else. – Matrix Dec 7 '12 at 10:25
Wordpress gets a bad reputation because of ( lets be honest here ) the major vulerabilities it has. Of course if you take an honest look at Sharepoint it also has major vulerabilities that have been patched. The difference I suppose is you hear less about Sharepoint because of how easy it is to update. Sounds like the comapny should just migrate to Sharepoint if thats what they plan on doing. – Ramhound Dec 7 '12 at 12:29
1  
I know what you mean, but Sharepoint is more much more annoying to design and develop... – novicePrgrmr Dec 7 '12 at 13:28
show 2 more comments

2 Answers

up vote 6 down vote accepted

It would depend on the version of Wordpress, in general the idea is that you need to patch your software and harden it to make it secure. But it's not that Wordpress is any less safe than Sharepoint.

Wordpress is in general well maintained and CVE's are patched or fixed quite rapidly. So if you keep up with these then it's safe to use Wordpress. (do mind that you need to keep track of your plugins as well)

If you don't do this in general, then your Sharepoint will probably be as insecure as your Wordpress (or any other software that's on your Intranet for that matter).

But saying that software X is insecure without providing any facts to support the statement is a bit stupid.

EDIT To compare intranet vs internet, the likelyhood is lower, but the impact is the same as on the internet.

share|improve this answer
2  
+1, though in my experience most CVEs come out of Wordpress plugins, which tend to get patched significantly less quickly. – Polynomial Dec 7 '12 at 9:19
Great info...So even if the intranet WP site is only available to a few internal IP addresses, as controlled via the .htaccess file, it still poses a security threat because of insecure plugins or an outdated WP installation? – novicePrgrmr Dec 7 '12 at 10:27
Yes you don't know who might have access to your intranet – Lucas Kauffman Dec 7 '12 at 10:30
Oh ok. So are you saying that the vulnerabilities would be internal? – novicePrgrmr Dec 7 '12 at 10:39
1  
Regardless if your application is on the intranet or internet, if you it's vulnerable it can be exploited. This could be a rogue employee or someone who has access to your systems on the intranet or some hackers on the internet. – Lucas Kauffman Dec 7 '12 at 10:57
show 2 more comments
up vote 4 down vote

Wordpress is insecure as any other CMS. If you update the software regularly, do the basics for make your site secure (you should visir http://codex.wordpress.org/Hardening_WordPress) and do not let people fro outside access, you should have no problems.

Like any ohter product, is reasonably secure if you try to make it secure, if you only install the product and forget the security for years until something happens, any product will be.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.