Drupal and Security: What You Need to Know

Drupal and Security: What You Need to Know

• 1.
  Drupal and Security Whatyou need to know Stephane Corlosquet 29th September 2015
• 2.
  Stéphane "scor" Corlosquet 9+ years withDrupal Drupal Security Team member RDF in core + contrib Definitive Guide to Drupal 7 We're hiring
• 3.
  Lots of things to cover Server environment Server config Personalpractices Drupal Configuration Code
• 4.
  A disaster foretold— and ignored
• 5.
  General tips Use HTTPS, SSH,SFTP Strong password policy Server – LAMP stack Require SSH keys Take & verify your backups for sharingSanitize backups
• 6.
  Secure site configuration Keep your sitesettings secure Text formats PHP module PHP in other modules Roles and permissions
• 7.
  Secure site configuration File permissions: webserver user forbidden to change code PHP execution: restrict in .htaccess or Nginx config Drupal handbook for securing your site
• 8.
  Drupal specific hosting Can your hostingprovider help you improve your security process? & Tuned for Drupal security (and performance) Code, DB, uploaded files, config Managed security updates Acquia Cloud Insight Acquia Remote administration
• 9.
  Modules enhancing security / Secure Login Paranoia Security Review PermissionsLock Hacked! Password policy Password strength Two Factor Authentication
• 10.
  PCI, HIPAA, SOC1, SOC2, SCADA Be aware ofthe regulations in your environment Anyone work in HIPAA environment? FedRAMP/FISMA Certification & Accreditation (C&A)? Anyone work with Drupal in SCADA environment? Drupal PCI Compliance Report
• 11.
  Security process Ongoing maintenance Budget forsecurity Managed hosting Drupal.org packaging infrastructure
• 12.
  Security process Keep Drupal codesecure in core and contrib Educate the community on security best practices Developers Site builders Site administrators and users Decision makers for every security release Drupal Security Team Security Advisory
• 13.
  Security process https://www.acquia.com/blog/keeping-drupal-secure
• 14.
  Security process
• 15.
  Security process
• 16.
  Security process
• 17.
  What are the most common issues?
• 18.
  What are the most common issues?
• 19.
  What is XSS? Cross Site Scripting Codein the browser Making requests Parsing responses Javascript, Flash, Java, etc.
• 20.
  Testing for XSS <script>alert('title');</script> <img src="a" onerror="alert('title');"> Catches90%
• 21.
  Fixing XSS? Filter text On outputto browser As late as reasonable Some API filters where reasonable t() and @text and %text placeholders
• 22.
  Precautions against XSS
• 23.
  What is Access Bypass? User can seeor do something That permissions/access should prevent
• 24.
  Where do we enforce it? Menu 'access callback' if(user_access('seesomething')); Node access system Entity access Field access Services & Ajax apis? In templates
• 25.
  Testing for Access Bypass Visit node/nid etc. Visitanything/%node Use behat
• 26.
  Fixing Access Bypass? user_access for permissions node_access entity_access $query->addTag('node_access'); menudefinitions write automated tests
• 27.
  What is CSRF? path that doesnot confirm intent <img src=" " >http://example.com/node/1/quickdelete
• 28.
  Testing for CSRF $_GET, $_POST, nouse of drupal_get_token() "verb" menu callbacks without token
• 29.
  Fixing CSRF? Use Form API:confirmation forms Send and validate tokens Protect Against CSRF webinar with greggles
• 30.
  Drupalgeddon - core SQL injection 2014 SQL injection leadto arbitrary code execution Plan your security updates! Exploited soon after the release Mitigated on Acquia Cloud Handbook for how to recover from a breach
• 31.
  Drupal 7 Security improvements
• 32.
  Drupal 7 Stronger password hashing/ salt Login flood control prevents brute-force credential guessing Protected cron prevents Denial of Service attacks Update manager Update module from the web UI
• 33.
  Drupal 7 Update Manager
• 34.
  Drupal 7 Update Manager Notifications
• 35.
  Drupal 8 Security improvements
• 36.
  Drupal 8: Twig Automatically sanitizes stringson output # Drupal 7 if (isset($variables['link_path'])) { $output = l($variables['name'] . $variables['extra'], $variables['link_path'], $variabl } else { $output = '<span' . drupal_attributes($variables['attributes_array']) . '>' . $variable } return $output; # Drupal 8 {% if link_path -%} <a{{ attributes }}>{{ name }}{{ extra }}</a> {%- else -%} <span{{ attributes }}>{{ name }}{{ extra }}</span> {%- endif -%}
• 37.
  Drupal 8: Twig No PHP intemplates {% if link_path -%} <a{{ attributes }}>{{ name }}{{ extra }}</a> {%- else -%} <span{{ attributes }}>{{ name }}{{ extra }}</span> {%- endif -%}
• 38.
  Drupal 8: WYSIWYG in core Streamlined filter mechanism(server and client side) No more full HTML as last resort
• 39.
  Drupal 8: PHP Removed PHP module
• 40.
  Drupal 8: Built-in CSRF tokens CSRF tokens builtin the routing system # views_ui.routing.yml views_ui.enable: path: '/admin/structure/views/view/{view}/enable' defaults: _controller: 'Drupalviews_uiControllerViewsUIController::ajaxOperation' op: enable requirements: _entity_access: view.enable _csrf_token: 'TRUE'
• 41.
  Drupal 8: lots more hardening PDO MySQL limitedto executing single statements PHP execution in subfolders forbidden in .htaccess Clickjacking protection per default with X-Frame- Options Hashed user session IDs in the DB Trusted hosts pattern to restrict URL domains Blog post: 10 Ways Drupal 8 Will Be More Secure
• 42.
  Book on Security in Drupal
• 43.
  References Drupal Security Advisories DrupalSecurity Team Drupal Security report Drupal Security Best Practices guide DGD7 chapter 6 https://groups.drupal.org/security Security on docs.acquia.com
• 44.
  Thanks! Got questions? Contact @scorlosquet [email protected]