Can someone offer me an objective analysis of Drupal's security?

Are you writing your own code? Either way (as with any software) there are always going to be (potential) security issues -- fortunately, almost to the point of, "... for cryin' out loud, people.", and also after having worked with Joomla!, Wordpress, etc., Drupal runs circles around everyone else as far as "being on top of security issues" goes.

I think one reason stems from making proactive (as opposed to reactive) decisions / security implementations. Another is the strict coding standards Drupal has implemented. For example, take a look at developer sections for Drupal vs. Joomla vs. WP. You'll notice that within Drupal's are hundreds of pages about coding standards, best practices, etc. Joomla's has actually improved quite a bit, but is still so "vague" it's difficult to follow. WP's is pretty much infinitesimal; and nothing personal against WP, because it's great software -- but every piece of software will always have room for improvement and this, currently, happens to be one of theirs.

Enough "dissertation" for now though and back on point (to the first question I asked) -- if you are writing you own code, Drupal has made several proactive solutions available. I would say it's a good idea to make sure you're especially familiar with Drupal functions such as l(), t(), and check_plain() to name a few.

On a side note, which "local paper" are you referring to? I grew up in the AV/SCV area (in fact my brother is a CHP officer @ Newhall), and it can't be the "primary AV paper" -- have you seen it lately? Holy cow. Only other one I could think of would be the DN - SCV ed, but even that didn't look too Joomla-ish to me (but who knows).

Modules in Drupal are a lot like Lego blocks. You can put them together in all manner of configurations. Of course, you can also leave a gap here and there, depending on how you configure those modules to play together.

For example, the Views module can produce listings of content that might be access-restricted on it's original page, but is publicly available if you don't pay attention to the Views security options.

One of the security "features" of modules in Drupal is the tireless work performed by the Drupal Security team in reviewing even contributed modules. There is a mailing list you can subscribe to for updates on security holes.

You may want to check out Cracking Drupal. It is a book on Drupal Security and is supposed to be very good.

Thanks for mentioning my book, Grayside ;) We're also working to make the CrackingDrupal.com site valuable as a resource on its own in addition to the book.

Ben Jeavons and I (both members of the security team and the developers behind the first security review services for Drupal) are looking for sponsors to help fund the research and writing of a statement about how Drupal handles security. If you or anyone else is interested in seeing this kind of a report, please contact us. The results will be made available as a creative commons licensed document that give credit to sponsors as appropriate.

It is compared to all CMS choices here: we recommend Drupal for website at or over $2000

http://socialmediasystems.com/rothmanguide/

A security report was released last month at DrupalCon San Francisco.

Addressing ongoing questions about Drupal security, the paper analyzes the Security Team's Security Advisories and discusses how Drupal 6 and 7 address common and critical security risks, including those of the OWASP Top Ten.

We couldn't have done it without the help of our sponsors, including Cydeck and Examiner.com among others, and without the help of our reviewers. Thank you!

If you're evaluating Drupal for use on your site, this report is for you. Or, if you're just curious to know more about Drupal and how it addresses security risks please give it a read.