Protect Your Drupal Site Against Common Security Attacks
•
1 recomendación•1,295 vistas
Acquia Webinar [Oct 25, 2011]: Protect Your Drupal Site Against Common Security Attacks Recording: http://acquia.com/resources/recorded_webinars
Recomendados
Más contenido relacionado
Similar a Protect Your Drupal Site Against Common Security Attacks
Similar a Protect Your Drupal Site Against Common Security Attacks (20)
Más de Acquia
Más de Acquia (20)
Último
Último (20)
Protect Your Drupal Site Against Common Security Attacks
- 1. Protect Your Drupal Site Against Common Security Attacks @greggles greg.knaddison@acquia.com Tuesday, October 25, 2011
- 2. Agenda • Security theory - general ideas - what it means to be a “Vendor” - what are other vendors doing? • Security Review module • Acquia Security Audits Tuesday, October 25, 2011
- 3. Some General Theories • Vuln is not a problem until someone exploits it • Least privilege • Validate on input, filter on output • Out of band communication - Multi factor authentication • Logging • Defense in depth Tuesday, October 25, 2011
- 4. Tuesday, October 25, 2011
- 5. Tuesday, October 25, 2011
- 6. Tuesday, October 25, 2011
- 7. Tuesday, October 25, 2011
- 8. Is Drupal secure enough? • DrupalSecurityReport.org • What is Drupalʼs vendor process? Tuesday, October 25, 2011
- 9. What is the flow? • Vulnerability introduced in code • Issue gets reported • Maintainer is notified & fixes • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Tuesday, October 25, 2011
- 10. What is public/private?* *ideal case • Vulnerability introduced in code • Issue gets reported • Maintainer is notified & fixes Private • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Public Tuesday, October 25, 2011
- 11. Where are you at risk? • Vulnerability introduced in code • Issue gets reported • Maintainer is notified & fixes • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Tuesday, October 25, 2011
- 12. Disclosure concepts • Full disclosure: - immediately disclose to world - Allow people to fix/protect themselves • Responsible disclosure: - Disclose to vendor privately - Wait up to 6 months for vendor fix/announcement - Patch available with news Tuesday, October 25, 2011
- 13. Where are you at risk? FD • Vulnerability introduced in code • Issue gets reported • Maintainer is notified & fixes • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Tuesday, October 25, 2011
- 14. Where are you at risk? RD • Vulnerability introduced in code • Issue gets reported • Maintainer is notified & fixes • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Tuesday, October 25, 2011
- 15. Who is responsible? dev • Vulnerability introduced in code researcher • Issue gets reported team • Maintainer is notified & fixes team+dev • Review/discussion • Security Advisory written, commit, release • Release and announce • Deployed on all sites Tuesday, October 25, 2011
- 16. Best practices as a vendor What is everyone else doing? Tuesday, October 25, 2011
- 17. Tuesday, October 25, 2011
- 18. Comparing • Given enough eyeballs, all bugs are shallow. • Prevention of issues: education • Smooth reporting • Announce, deploy updates Tuesday, October 25, 2011
- 19. Try this • search for - “write secure code $project_name” - “report security issue $project_name” - “security release $project_name” Tuesday, October 25, 2011
- 20. Tuesday, October 25, 2011
- 21. This is not our policy....We are proud of our track record of quickly releasing critical security patches, often in days. We work hard to ship fixes as fast as possible because it keeps people safe. Mozilla Security Blog 2010 revenue: $104,000,000+ expenses $60,000,000+ Tuesday, October 25, 2011
- 22. Chrome, Firefox bounties • Mozilla: $0 to $3,000http://www.mozilla.org/security/bug-bounty.html • Chrome: $500 to $3,133.7 blog.chromium.org/2010/07/celebrating-six-months-of-chromium.html • Tipping Point Zero Day Initiative: $100 to $2,000+ • Drupal: $0 Tuesday, October 25, 2011
- 23. Browser Updates • Blogs, tweets, mails and in app notifications • Automatic updates enabled by default • Download compressed binary diffs • Pretty reliable (remember, $104,000,000/year budget) Tuesday, October 25, 2011
- 24. WordPress • Usability focused • Blogging focused • Increasingly feature rich Tuesday, October 25, 2011
- 25. Education/reporting • http://codex.wordpress.org/ Category:WordPress_Development - zero security • E-mail based reporting system • Plugins - hosted anywhere - Plugins on WP.org not as rigorously reviewed - Plugins elsewhere not reviewed - Some in svn/Trac plugins.trac.wordpress.org/browser/ Tuesday, October 25, 2011
- 26. Tuesday, October 25, 2011
- 27. Tuesday, October 25, 2011
- 28. Tuesday, October 25, 2011
- 29. Out of application notification tools • News for core: wordpress.org/news/category/security • No official, security-focused twitter (?) • Popularity + Limited official channel = NOISE Tuesday, October 25, 2011
- 30. Github: Suzieʼs System! • Github has no built-in facility • Project maintainers have to build it Infrastructure has value Tuesday, October 25, 2011
- 31. Drupal • Focused on... • Can do whatever • Modules usually hosted on drupal.org • Project application process is rigorous, but flawed • Centralized code hosting git/gitweb drupalcode.org Tuesday, October 25, 2011
- 32. Education/Reporting • Handbooks put security as a priority • New contributor process includes security review - Doesnʼt cover all projects - There are ways around it • E-mail based reporting process - no registration required - moving to optional ticket submission for improved efficiency Tuesday, October 25, 2011
- 33. Tuesday, October 25, 2011
- 34. Tuesday, October 25, 2011
- 35. Tuesday, October 25, 2011
- 36. Tuesday, October 25, 2011
- 37. Out of application tools • Main handbook has solid security docs • News & feeds for core and contrib • Announcement e-mail list • @drupalsecurity, @drupal_security • Limited 3rd party noise Tuesday, October 25, 2011
- 38. Security Review module • Freely available module • Identifies mistakes in permissions & configuration • Has drush integration • Hands on demo http://drupal.org/project/security_review Tuesday, October 25, 2011
- 39. How Acquia Can Help • Acquia Security Audit • Acquia Insight Tuesday, October 25, 2011
- 40. How Acquia Can Help • 1 week long engagement • Most vulnerabilities are found in site specific - themes - configurations - modules • Drupal core and contrib may be safe, is your code? Tuesday, October 25, 2011
- 41. What do we do? • Automated static code analysis • Penetration testing • Public and Acquia-developed tools Tuesday, October 25, 2011
- 42. What is the output? Tuesday, October 25, 2011
- 43. Thanks! Questions? Contact: greg.knaddison@acquia.com @greggles Tuesday, October 25, 2011
- 44. Photos photos • http://www.flickr.com/photos/jdhancock/3760104591/ • http://www.flickr.com/photos/danielsphotography/466435567/ • http://www.flickr.com/photos/38485387@N02/3580728177/ • http://www.flickr.com/photos/tchi-tcha/2447184214 Tuesday, October 25, 2011