Posted by robin.prieschl on October 31, 2014 at 3:09am
In light of the recent Drupal Core vulnerability (https://www.drupal.org/SA-CORE-2014-005) and drupal.org's Public Service Announcement (https://www.drupal.org/PSA-2014-003) I would like to know if there is anyone would would like to speak at the Drupal Meetups about Drupal Security. This goes for both Johannesburg and Cape Town Meetups. This could be one speaker for both or separate speakers for respective regions.
Some things to cover could be:
- Default configuration to make your Drupal installation secure.
- Recommended modules.
- How to keep Drupal secure (Maintenance methods, automated and other).
- How to determine if your site has been hacked.
- I have been hacked...what now?
- Backup strategies.
These are some initial thoughts, if anyone has other suggestions, please add below.
Thanks
Comments
That would be a great idea
I find the advisory by the Drupal security team perfect. Advice for something like this should not allow for a marginal option to put one's head in a hole or for business interest to be able to argue a site's exceptionalism that is was not compromised or can be "quickly scanned" to determine if it was compromised.
Only very certain methods can be suggested. For example, running a diff on files and the database from before and after the 15th on a clean newly installed operating system. Even then, depending on data added to the database after the 15th, one would have to have a very careful audit of that data. From the simplest check on new users' roles to compromised content data.
I wonder if this shouldn't be a discussion more than a presentation. Things like backups and how a server, especially one shared with other sites, should be set up can be so diverse. For many companies this is also their secret sauce. Perhaps we can press Lee or Wayne to lead a discussion like this for us? Wayne's already in cape Town, I think, and will likely be up in Johannesburg again later, so can easily pollinate the ideas for us at two talks. I'll ask.
Feb Talk
Good morning all,
I would be more than happy to do a general security + drupal security chat / discussion / presentation. Think we really all need to focus on having a security focussed mindset when developing for a hostile environment.
I think the drupal sec team are doing a great job, but it's up to us as users to make sure we follow those advisories.
P.S. Robin - What are you doing up at 5am?
() ascii ribbon campaign - against html e-mail
/\
Great Idea!
It sounds a great idea! As I come from China,so can you share your present slides if you who made this speech?
个人公众号：左手读写
My top tips
My tips are:
But that's only a start. There are many ways to hack drupal.
Yeah，We'll to hack a drupal site too
Yeah，We'll to hack a drupal site too when we meet up.
个人公众号：左手读写