Keeping your Drupal site secure 2013

Feb 4, 2014Download as ODP, PDF1 like937 views

This document discusses keeping Drupal sites secure. It recommends using HTTPS, SSH, strong passwords, and limiting permissions. Drupal 7 introduced stronger password hashing and login flood control. Modules can enhance security, and hosted options like Pantheon focus on security updates. Site maintainers should follow best practices, take backups, and sanitize shared backups. Drupal 8 introduces Twig templating to prevent PHP execution and filters uploaded images to the same site. References are provided for further security information.

Keeping your
Drupal Site Secure
Stéphane Corlosquet scorlosquet@gmail.com
Training at BADCamp
October, 2013

General tips
●

Use HTTPS, SSH, SFTP

●

Strong password policy

●

Server – LAMP stack

●

Require SSH keys

●

Roles and permissions

●

Keep your site settings secure
–
–
–

Permissions
Text formats
PHP filter

Drupal 7
●

Stronger password hashing / salt

●

Login flood control
–

●

Protected cron
–

●

prevents brute-force credential guessing
prevents Denial of Service attacks

Update manager
–

Update module from the web UI

Modules enhancing security
●

Secure login

●

Password policy

●

Paranoia

●

Hacked!

●

Permissions Lock

Drupal specific hosting
●

Can your hosting provider help you improve
your security process?
●
●

●

Insight (part of Acquia Cloud hosting)
Pantheon (self-service security updates)

Tuned for Drupal security (and performance)
●

Code, DB, uploaded files, config

●

Managed security updates:
–

Remote administration (Acquia)

Security process
●

Ongoing maintenance

●

Cost

●

Managed hosting

●

Drupal.org packaging infrastructure

Security process
●

Drupal Security Team
●

Keep Drupal code secure in core and contrib

●

Educate the community on security best practices
–
–
–
–

●

Developers
Site builders
Site administrators and users
Decision makers

Security Advisory for every security release

Developers & site maintainers
●

Follow Drupal APIs and best practices

●

Take & verify backups

●

Sanitize backups for sharing

Drupal 8
●

Twig as templating language
–
–

●

WYSIWYG in core
–
–

●

Automatically sanitizes strings on output
No PHP in templates
Streamlined filter mechanism (server and client side)
No more full HTML as last resort

Local image input filter
–

Only allow images from same site

References
●

DGD7 chapter 6

●

http://drupal.org/security

●

http://www.drupalscout.com/

●

http://groups.drupal.org/best-practices-drupal-security

Thanks!
●

Stéphane Corlosquet:
–
–
–

scorlosquet@gmail.com
@scorlosquet
http://openspring.net/

Nginx is an alternative to Apache for serving WordPress sites that provides better performance, scalability, and ability to proxy static files. It uses a non-blocking architecture that allows it to handle more requests with fewer system resources. Nginx may be a good choice for new server installs, sites where performance is critical, or as a front-end proxy. Its configuration involves setting up sites, includes, PHP fastcgi processing, and additional settings for multisite installations. Proper security practices should always be followed.

Selfhosted HostingMartin Huber

��

Стажировка 2015. Разработка. Занятие 5. Использование nginx7bits

��

This document provides an overview of how to install and configure the Nginx web server on Ubuntu. It discusses: 1. Installing Nginx using the command "sudo apt-get install nginx". 2. The directory structure of an Nginx installation, including configuration files and virtual host configurations. 3. Examples of basic Nginx server configurations, including serving static files and adding additional configuration options.

ATUL UPADHYAY ADMINATUL UPADHYAY

��

This document contains a resume for Atul Upadhyay. He has over 2.8 years of experience as a Linux System Administrator working for Wipro Infotech. His responsibilities include managing and configuring various Linux servers, implementing and maintaining SAMBA, FTP, and NFS servers, and providing support for DHCP, DNS, and Apache servers. He has a BCA from CSJM University and certifications in Red Hat 6/7 and hardware and networking from JETKING. His technical skills include configuring NIS, Samba, Sendmail, Apache, DHCP, DNS, Squid, RAID, and LVM. He aims to continue learning and improving his skills.

Schema.org & Drupal (FR)scorlosquet

��

Drupal 7 and schema.org module (Jan 2012)scorlosquet

��

Using schema.org to improve SEOscorlosquet

��

Drupal Security HardeningGerald Villorente

��

Drupal Security HardeningGerald Villorente

��

Drupal and security - Advice for Site Builders and CodersArunkumar Kupppuswamy

��

The recent SA-CORE-2014-005 vulnerability has demonstrated that hackers have learnt how to take advantage of Drupal’s functionality to infect a site and go unnoticed. Site builders and site maintainers have a large role to play in preventing these kinds of disasters. Security doesn’t have to be a pain to implement and plan for. The primary goal of this session is to give people a solid basis in the most common security issues so they can quickly identify those security issues. From there, we'll move into some other common pain-points of site builders like frequently made mistakes, modules to enhance security, and evaluating contributed module quality.

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Hong Kong Drupal User Group - Nov 8thWong Hoi Sing Edison

��

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Nagios Conference 2013 - Sam Lansing - Getting Started With Nagios XI, Core, ...Nagios

��

The Ultimate Drupal Launch ChecklistSnake Hill Web Agency

��

OSCamp 2019 | #3 Ansible: Foreman Discovery by Adam RuzickaNETWAYS

��

This document provides an overview and agenda for discovering Foreman, an open source tool for provisioning, configuration management, and monitoring of infrastructure and applications. It discusses Foreman's capabilities for provisioning systems to various environments, configuring systems using Puppet, Chef, Salt, and Ansible, and monitoring systems through a generic reporting API. The document also covers Foreman's architecture, installation, customization through plugins and APIs, and provides a demonstration of its provisioning capabilities.

[HKDUG] #20180512 - Fix Hacked Drupal with GITWong Hoi Sing Edison

��

The document discusses how to fix a hacked Drupal site using version control with GIT. It recommends stopping public access, illegal processes, backing up files and databases. Comparing the hacked site to a clean baseline version using GIT to identify changes. Reducing differences and migrating useful files. Restoring the database and upgrading core/modules to the latest versions before restoring the fixed site.

Drupal and Security: What You Need to KnowAcquia

��

Security breaches are becoming more common in today’s world, from large vulnerable corporations being attacked to cyber attacks causing physical damage. With Drupal becoming increasingly more popular, it has become a perfect target for these automated attacks. Last year's SA-CORE-2014-005 vulnerability has demonstrated that hackers have learned how to take advantage of Drupal’s functionality to infect a site and remain unnoticed. Site builders and maintainers have a large role to play in preventing these kinds of disasters. With a solid knowledge base of the most common security threats, developers can quickly identify those security issues and learn how to address them. In this webinar, learn about how to protect your Drupal site against security threats, with topics including: - How Drupal can protect against DDoS attacks - Configuration mistakes that make you vulnerable, and how to avoid them - Fast updates: the single most important security element Security improvements in Drupal 8 - Modules to enhance security and evaluating contributed module quality

User Management and Privileges - pfSense Hangout February 2015Netgate

��

Open Innovation Lab (OIL) - 2014 Sep 26thWong Hoi Sing Edison

��

Moodle Development Best PracitcesJustin Filip

��

Becoming A Drupal Master BuilderPhilip Norton

��

Becoming a drupal master builder - Given at Drupal Camp London 2016 I've been building Drupal sites for a number of years and have a broad experience building Drupal sites with various levels of complexity. I often work with other agencies to build Drupal sites or to migrate existing sites and as a result I will often see some very common mistakes and errors that shouldn't be happening. Due to Drupal's popularity I also see Drupal sites in the wild and can clearly see the same mistakes going on there as well. During this talk I'll show some basic site building tips as well as some more complex and technical strategies that will make your Drupal sites better and more maintainable. Rather than just show you what to do, I'll also be explaining why doing those things are important and how developers and their websites will benefit from them. Although I'll be mainly concentrating on Drupal 7, some of these techniques are also applicable to Drupal 8.

Intro to XPages for Administrators (DanNotes, November 28, 2012)Per Henrik Lausten

��

This document introduces XPages for administrators. It discusses: - What XPages are and examples of XPages applications - The administrator's important role in the application lifecycle in helping developers and users - Tips for maximizing performance such as hardware configuration, server settings, caching, and preloading applications - Application development best practices including supported Dojo and OneUI versions - Configuring and administering Domino Directory, Internet sites, and security settings - Tools for troubleshooting, monitoring, and impressing developers like the Extension Library and demo app

006.itsecurity bcp v1Mohammad Ashfaqur Rahman

��

This document provides an overview of operating system and server security. It discusses key functions of an operating system including resource management, user interface, running programs, and security enforcement. It then covers possible attacks like password cracking, unauthorized access to resources, and placement of rootkits. The document gives examples of hardening techniques for user management, password policies, limiting services and access, and setting permissions on Linux and Windows systems. It stresses the importance of both OS and physical security, and provides hardware security best practices like firmware updates, unique credentials, and secure SNMP configuration.

Course_Presentation cyber --------------.pptxssuser020436

��

This document provides an agenda for a web application penetration testing course. The course aims to share cybersecurity knowledge in Arabic and focus on practical application. It will cover Linux basics, Burp Suite, common web vulnerabilities at easy and medium levels, and advanced topics like XSS and CSRF. Students will learn how to find data leaks, analyze protocols and network traffic, exploit vulnerabilities, and earn money through bug bounty programs.

Escalando php e drupal- performance ao infinito e além! - Drupal camp sp 2015Handrus Nogueira

��

This document discusses strategies for scaling PHP and Drupal applications. It recommends using the latest stable version of PHP and disabling unnecessary PHP extensions and modules to improve performance. It also discusses tuning PHP settings like memory limits and caches. For Drupal, it suggests using caching, database optimizations like read replicas, and balancing load across multiple servers. Profiling tools can help identify bottlenecks.

Escalando php e drupal- performance ao infinito e além! - DrupalCamp SP 2015Handrus Nogueira

��

DrupalCamp NJ 2014 Solr and Schema.orgscorlosquet

��

The document discusses how search engines are incorporating knowledge graphs and rich snippets to provide more detailed information to users. It describes Google's Knowledge Graph and how search engines like Bing are implementing similar features. The document then outlines how the Schema.org standard and modules like Schema.org and Rich Snippets for Drupal can help structure Drupal content to be understood by search engines and displayed as rich snippets in search results. Integrating these can provide benefits like a consistent search experience across public and private Drupal content.

The Future of Search and SEO in Drupalscorlosquet

��

Stéphane Corlosquet and Nick Veenhof presented on the future of search and SEO. They discussed how search engines like Google are moving towards knowledge graphs that understand relationships between entities rather than just keyword matching. They explained how the Schema.org standard and modules like Schema.org and Rich Snippets for Drupal help structure Drupal content to be understood by search engines and display rich snippets in search results. The presentation demonstrated how these techniques improve search and allow Drupal sites to integrate with non-Drupal data.

More Related Content

Similar to Keeping your Drupal site secure 2013 (20)

Drupal Security HardeningGerald Villorente

��

Drupal Security HardeningGerald Villorente

��

Drupal and security - Advice for Site Builders and CodersArunkumar Kupppuswamy

��

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Hong Kong Drupal User Group - Nov 8thWong Hoi Sing Edison

��

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Nagios Conference 2013 - Sam Lansing - Getting Started With Nagios XI, Core, ...Nagios

��

The Ultimate Drupal Launch ChecklistSnake Hill Web Agency

��

OSCamp 2019 | #3 Ansible: Foreman Discovery by Adam RuzickaNETWAYS

��

[HKDUG] #20180512 - Fix Hacked Drupal with GITWong Hoi Sing Edison

��

Drupal and Security: What You Need to KnowAcquia

��

User Management and Privileges - pfSense Hangout February 2015Netgate

��

Open Innovation Lab (OIL) - 2014 Sep 26thWong Hoi Sing Edison

��

Moodle Development Best PracitcesJustin Filip

��

Becoming A Drupal Master BuilderPhilip Norton

��

Intro to XPages for Administrators (DanNotes, November 28, 2012)Per Henrik Lausten

��

006.itsecurity bcp v1Mohammad Ashfaqur Rahman

��

Course_Presentation cyber --------------.pptxssuser020436

��

Escalando php e drupal- performance ao infinito e além! - Drupal camp sp 2015Handrus Nogueira

��

Escalando php e drupal- performance ao infinito e além! - DrupalCamp SP 2015Handrus Nogueira

��

Drupal Security HardeningGerald Villorente

��

Drupal Security HardeningGerald Villorente

��

Drupal and security - Advice for Site Builders and CodersArunkumar Kupppuswamy

��

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Hong Kong Drupal User Group - Nov 8thWong Hoi Sing Edison

��

Hong kong drupal user group nov 8th - drupal 7.32 security vulnerabilityAnn Lam

��

Nagios Conference 2013 - Sam Lansing - Getting Started With Nagios XI, Core, ...Nagios

��

The Ultimate Drupal Launch ChecklistSnake Hill Web Agency

��

OSCamp 2019 | #3 Ansible: Foreman Discovery by Adam RuzickaNETWAYS

��

[HKDUG] #20180512 - Fix Hacked Drupal with GITWong Hoi Sing Edison

��

Drupal and Security: What You Need to KnowAcquia

��

User Management and Privileges - pfSense Hangout February 2015Netgate

��

Open Innovation Lab (OIL) - 2014 Sep 26thWong Hoi Sing Edison

��

Moodle Development Best PracitcesJustin Filip

��

Becoming A Drupal Master BuilderPhilip Norton

��

Intro to XPages for Administrators (DanNotes, November 28, 2012)Per Henrik Lausten

��

006.itsecurity bcp v1Mohammad Ashfaqur Rahman

��

Course_Presentation cyber --------------.pptxssuser020436

��

Escalando php e drupal- performance ao infinito e além! - Drupal camp sp 2015Handrus Nogueira

��

Escalando php e drupal- performance ao infinito e além! - DrupalCamp SP 2015Handrus Nogueira

��

More from scorlosquet (15)

DrupalCamp NJ 2014 Solr and Schema.orgscorlosquet

��

The Future of Search and SEO in Drupalscorlosquet

��

Drupal and the Semantic Web - ESIP Webinarscorlosquet

��

This document summarizes a presentation about using semantic web technologies like the Resource Description Framework (RDF) and Linked Data with Drupal 7. It discusses how Drupal 7 maps content types and fields to RDF vocabularies by default and how additional modules can add features like mapping to Schema.org and exposing SPARQL and JSON-LD endpoints. The presentation also covers how Drupal integrates with the larger Semantic Web through technologies like Linked Open Data.

The Semantic Web and Drupal 7 - Loja 2013scorlosquet

��

Drupal as a Semantic Web platform - ISWC 2012scorlosquet

��

�ݺ�ߣs semantic web and Drupal 7 NYCCamp 2012scorlosquet

��

Data strategies - Drupal Decision Makers trainingscorlosquet

��

This document discusses data strategies in Drupal, including using structured data like Schema.org to enhance search engine results. It explains how to describe content types and their properties to help machines understand web pages. The document also introduces RDF extensions that allow Drupal to expose structured data through formats like RDF, JSON-LD and SPARQL to integrate with the semantic web.

Drupal and the semantic web - SemTechBiz 2012scorlosquet

��

This document provides a summary of a presentation on leveraging the semantic web with Drupal 7. The presentation introduces Drupal and its uses as a content management system. It discusses Drupal 7's integration with the semantic web through its built-in RDFa support and contributed modules that add additional semantic web capabilities like SPARQL querying and JSON-LD serialization. The presentation demonstrates these semantic web features in Drupal through examples and demos. It also introduces Domeo, a web-based tool for semantically annotating online documents that can integrate with Drupal.

Drupal 7 and schema.org modulescorlosquet

��

Drupal 7 and RDFscorlosquet

��

This document discusses Drupal 7 and its new capabilities for representing content as Resource Description Framework (RDF) data. It provides an overview of Drupal's history with RDF and semantic technologies. It describes how Drupal 7 core is now RDFa enabled out of the box and how contributed modules can import vocabularies and provide SPARQL endpoints. The document advocates experimenting with the new RDF features in Drupal 7.

How to Build Linked Data Sites with Drupal 7 and RDFascorlosquet

��

RDF presentation at DrupalCon San Francisco 2010scorlosquet

��

The document discusses RDF and the Semantic Web in Drupal 7. It introduces RDF, how resources can be described as relationships between properties and values, and how this turns the web into a giant linked database. It describes Drupal 7's new RDF and RDFa support which exposes entity relationships and allows for machine-readable semantic data. Future improvements discussed include custom RDF mappings, SPARQL querying of site data, and connecting to external RDF sources.

Drupal and RDFscorlosquet

��

Drupal is an open source content management system that has been exposing its data in RDF format since 2006 through contributed modules. For Drupal 7, RDF support is being built directly into the core, allowing Drupal sites to natively publish structured data using vocabularies like FOAF, SIOC, and Dublin Core. This will empower Drupal users and site builders to more directly participate in the Web of Linked Data and help create new types of semantic applications.

When Drupal and RDF meetscorlosquet

��

This document discusses integrating RDF and semantic web technologies with the Drupal content management system. It provides an overview of Drupal, describes how its data model of content types and fields can be mapped to RDF classes and properties, and details an experiment exposing Drupal data in RDF format. It notes that Drupal 7 will natively support RDFa and help expose more linked data on the web through its large user base of over 227,000 sites.

Produce and Consume Linked Data with Drupal!scorlosquet

��

Currently a large number of Web sites are driven by Content Management Systems (CMS) which manage textual and multimedia content but also - inherently - carry valuable information about a site's structure and content model. Exposing this structured information to the Web of Data has so far required considerable expertise in RDF and OWL modelling and additional programming effort. In this paper we tackle one of the most popular CMS: Drupal. We enable site administrators to export their site content model and data to the Web of Data without requiring extensive knowledge on Semantic Web technologies. Our modules create RDFa annotations and - optionally - a SPARQL endpoint for any Drupal site out of the box. Likewise, we add the means to map the site data to existing ontologies on the Web with a search interface to find commonly used ontology terms. We also allow a Drupal site administrator to include existing RDF data from remote SPARQL endpoints on the Web in the site. When brought together, these features allow networked RDF Drupal sites that reuse and enrich Linked Data. We finally discuss the adoption of our modules and report on a use case in the biomedical field and the current status of its deployment.

DrupalCamp NJ 2014 Solr and Schema.orgscorlosquet

��

The Future of Search and SEO in Drupalscorlosquet

��

Drupal and the Semantic Web - ESIP Webinarscorlosquet

��

The Semantic Web and Drupal 7 - Loja 2013scorlosquet

��

Drupal as a Semantic Web platform - ISWC 2012scorlosquet

��

�ݺ�ߣs semantic web and Drupal 7 NYCCamp 2012scorlosquet

��

Data strategies - Drupal Decision Makers trainingscorlosquet

��

Drupal and the semantic web - SemTechBiz 2012scorlosquet

��

Drupal 7 and schema.org modulescorlosquet

��

Drupal 7 and RDFscorlosquet

��

How to Build Linked Data Sites with Drupal 7 and RDFascorlosquet

��

RDF presentation at DrupalCon San Francisco 2010scorlosquet

��

Drupal and RDFscorlosquet

��

When Drupal and RDF meetscorlosquet

��

Produce and Consume Linked Data with Drupal!scorlosquet

��

Recently uploaded (20)

Top Tips to Get Your Data AI-Ready‎ ‎ ‎‎ ‎Precisely

��

New from BookNet Canada for 2025: BNC SalesData and BNC LibraryDataBookNet Canada

��

Lily Dwyer updates us on what 2024 brought for SalesData and LibraryData. Learn about new features, such as the Age Range data and Page Count data filters, improvements to our internal Admin tool, and what’s in store for 2025. Link to video and transcript: https://bnctechforum.ca/sessions/new-from-booknet-canada-for-2025-bnc-salesdata-and-bnc-librarydata/ Read more: - https://www.booknetcanada.ca/salesdata - https://booknetcanada.atlassian.net/wiki/spaces/UserDocs/pages/53707258/SalesData+Help+Manual Presented by BookNet Canada on April 8, 2025 with support from the Department of Canadian Heritage.

Misc: The Internet Story - How Data Travels, Transit Works, and the Role of C...3G4G

��

Ever wondered how the Internet really works? In this tutorial, we break it all down—from how your home or office connects to the wider web, to the role of Internet Service Providers (ISPs), Transit Networks, Peering, Content Delivery Networks (CDNs), and Multi-access Edge Computing (MEC). 🔍 You’ll learn about: • How ISPs interconnect and form transit chains • What peering is and how it helps reduce latency and cost • How content like Netflix and Facebook reaches your screen • Real-world case studies like Swisscom vs Netflix & Init7 • The difference between CDN and MEC—and when each is used We also explore technical infrastructure using simple diagrams to explain how web servers, app servers, and storage systems come together to deliver your favourite content in real time. 📌 Whether you’re a student, tech enthusiast, or just curious about how the Internet works behind the scenes—this video is for you. 💬 Got questions or insights? Drop them in the comments—we’d love to hear from you! All our #3G4G5G slides, videos, blogs and tutorials are available at: Tutorials: https://www.3g4g.co.uk/Training/ Videos: https://www.youtube.com/3G4G5G �ݺ�ߣs: /3G4GLtd Our channels: 3G4G Website – https://www.3g4g.co.uk/ The 3G4G Blog – https://blog.3g4g.co.uk/ Telecoms Infrastructure Blog – https://www.telecomsinfrastructure.com/ Operator Watch Blog – https://www.operatorwatch.com/ Connectivity Technology Blog – https://www.connectivity.technology/ Free 5G Training – https://www.free5gtraining.com/ Free 6G Training – https://www.free6gtraining.com/ Private Networks Technology Blog - https://blog.privatenetworks.technology/

San Francisco Atlassian ACE - Mar 27 2025.pdfMatt Doar

��

Artificial Neural Networks, basics, its variations and examplesanandsimple

��

TNBC Research Presentation and medical virology .pptxMohamedHasan816582

��

Top 10 Mobile Hacking Tools – 2025 Editionanishachhikara2122

��

Explore the most powerful and widely-used mobile hacking tools in cybersecurity today. This presentation covers top tools like MobSF, Frida, Hopper, Ghidra, Objection, and more—highlighting their core features, use cases, platforms, and practical tips. Whether you're a security researcher, ethical hacker, or mobile app developer, this slide deck offers a well-rounded introduction to both static and dynamic analysis tools for Android and iOS. Ideal for training, awareness, and professional development.

Automating Behavior-Driven Development: Boosting Productivity with Template-D...DOCOMO Innovations, Inc.

��

https://bit.ly/4ciP3mZ We have successfully established our development process for Drupal custom modules, including automated testing using PHPUnit, all managed through our own GitLab CI/CD pipeline. This setup mirrors the automated testing process used by Drupal.org, which was our goal to emulate. Building on this success, we have taken the next step by learning Behavior-Driven Development (BDD) using Behat. This approach allows us to automate the execution of acceptance tests for our Cloud Orchestration modules. Our upcoming session will provide a thorough explanation of the practical application of Behat, demonstrating how to effectively use this tool to write and execute comprehensive test scenarios. In this session, we will cover: 1. Introduction to Behavior-Driven Development (BDD): - Understanding the principles of BDD and its advantages in the software development lifecycle. - How BDD aligns with agile methodologies and enhances collaboration between developers, testers, and stakeholders. 2. Overview of Behat: - Introduction to Behat as a testing framework for BDD. - Key features of Behat and its integration with other tools and platforms. 3. Automating Acceptance Tests: - Running Behat tests in our GitLab CI/CD pipeline. - Techniques for ensuring that automated tests are reliable and maintainable. - Strategies for continuous improvement and scaling the test suite. 4. Template-Based Test Scenario Reusability: - How to create reusable test scenario templates in Behat. - Methods for parameterizing test scenarios to enhance reusability and reduce redundancy. - Practical examples of how to implement and manage these templates within your testing framework. By the end of the session, attendees will have a comprehensive understanding of how to leverage Behat for BDD in their own projects, particularly within the context of Drupal and cloud orchestration. They will gain practical knowledge on writing and running automated acceptance tests, ultimately enhancing the quality and efficiency of their development processes.

AI in SEO Marketing Presentation (BY MetaSense Marketing)MetaSenseMarketing

��

Build Your Uber Clone App with Advanced FeaturesV3cube

��

Recruiting Tech: A Look at Why AI is Actually OGMatt Charney

��

Introduction to Generative AI refers to a subset of artificial intelligenceKongu Engineering College, Perundurai, Erode

��

Laravel Crud Tutorial Basic Step by Stepy Schristopherneo4

��

Q1 FY26 TUG Leader Quarterly Call - APAC / EMEAlward7

��

Transactional Outbox & Inbox Patterns.pptxMaysam Mousa

��

This presentation provides a comprehensive overview of the Transactional Outbox Pattern and the Inbox Pattern, two essential techniques for ensuring reliable and consistent communication in distributed systems. We start by clearly outlining the problem these patterns aim to solve—namely, maintaining data consistency between databases and message brokers in event-driven architectures. From there, we delve into what the Outbox Pattern is, how it works under the hood, and how it guarantees message delivery even in the face of failures. The presentation then shifts focus to the Inbox Pattern, explaining its role in ensuring idempotency and preventing duplicate processing of messages. Each concept is explained with simple language, diagrams, and a logical flow that builds a solid understanding from the ground up. Whether you’re an engineer building microservices or just exploring distributed system patterns, this talk provides clarity, practical insights, and a helpful demo to see the patterns in action. Topics Covered: * Problem Statement * Transactional Outbox Pattern * How It Solves the Problem * Internal Mechanics * Delivery Guarantees * Inbox Pattern Explained * Internal Workflow * Conclusions & Further Reading * Demo

Innovative Web Design | Malachite Technologiesmalachitetechnologie1

��

Future‑Proofing the Nordic Economy with GenAIPete Nieminen

��

AuthZEN The OpenID Connect of Authorization - Gartner IAM EMEA 2025David Brossard

��

Today, the authorization world is fractured - each vendor supports its own APIs & protocols. But this is about to change: OpenID AuthZEN was created in late 2023 to establish much-needed modern authorization standards. As of late 2024, AuthZEN has a stable Implementers Draft, and is expected to reach Final Specification in 2025. With AuthZEN, IAM teams can confidently externalize and standardize authorization across their application estate without being locked in to a proprietary API. This session will describe the state of modern authorization, review the AuthZEN API, and demo our 15 interoperable implementations.

ScotSecure Cyber Security Summit 2025 EdinburghRay Bugg

��

Scot-Secure is Scotland’s largest annual cyber security conference. The event brings together senior InfoSec personnel, IT leaders, academics, security researchers and law enforcement, providing a unique forum for knowledge exchange, discussion and high-level networking. The programme is focussed on improving awareness and best practice through shared learning: highlighting emerging threats, new research and changing adversarial tactics, and examining practical ways to improve resilience, detection and response.

Handout - Demonolithing Think Again (Devoxx GR 2025).pdfScott Sosna

��

Top Tips to Get Your Data AI-Ready‎ ‎ ‎‎ ‎Precisely

��

New from BookNet Canada for 2025: BNC SalesData and BNC LibraryDataBookNet Canada

��

Misc: The Internet Story - How Data Travels, Transit Works, and the Role of C...3G4G

��

San Francisco Atlassian ACE - Mar 27 2025.pdfMatt Doar

��

Artificial Neural Networks, basics, its variations and examplesanandsimple

��

TNBC Research Presentation and medical virology .pptxMohamedHasan816582

��

Top 10 Mobile Hacking Tools – 2025 Editionanishachhikara2122

��

Automating Behavior-Driven Development: Boosting Productivity with Template-D...DOCOMO Innovations, Inc.

��

AI in SEO Marketing Presentation (BY MetaSense Marketing)MetaSenseMarketing

��

Build Your Uber Clone App with Advanced FeaturesV3cube

��

Recruiting Tech: A Look at Why AI is Actually OGMatt Charney

��

Introduction to Generative AI refers to a subset of artificial intelligenceKongu Engineering College, Perundurai, Erode

��

Laravel Crud Tutorial Basic Step by Stepy Schristopherneo4

��

Q1 FY26 TUG Leader Quarterly Call - APAC / EMEAlward7

��

Transactional Outbox & Inbox Patterns.pptxMaysam Mousa

��

Innovative Web Design | Malachite Technologiesmalachitetechnologie1

��

Future‑Proofing the Nordic Economy with GenAIPete Nieminen

��

AuthZEN The OpenID Connect of Authorization - Gartner IAM EMEA 2025David Brossard

��

ScotSecure Cyber Security Summit 2025 EdinburghRay Bugg

��

Handout - Demonolithing Think Again (Devoxx GR 2025).pdfScott Sosna

��

Keeping your Drupal site secure 2013

1. Keeping your Drupal Site Secure Stéphane Corlosquet scorlosquet@gmail.com Training at BADCamp October, 2013

2. General tips ● Use HTTPS, SSH, SFTP ● Strong password policy ● Server – LAMP stack ● Require SSH keys ● Roles and permissions ● Keep your site settings secure – – – Permissions Text formats PHP filter

3. Drupal 7 ● Stronger password hashing / salt ● Login flood control – ● Protected cron – ● prevents brute-force credential guessing prevents Denial of Service attacks Update manager – Update module from the web UI

4. Modules enhancing security ● Secure login ● Password policy ● Paranoia ● Hacked! ● Permissions Lock

5. Drupal specific hosting ● Can your hosting provider help you improve your security process? ● ● ● Insight (part of Acquia Cloud hosting) Pantheon (self-service security updates) Tuned for Drupal security (and performance) ● Code, DB, uploaded files, config ● Managed security updates: – Remote administration (Acquia)

6. Security process ● Ongoing maintenance ● Cost ● Managed hosting ● Drupal.org packaging infrastructure

7. Security process ● Drupal Security Team ● Keep Drupal code secure in core and contrib ● Educate the community on security best practices – – – – ● Developers Site builders Site administrators and users Decision makers Security Advisory for every security release

8. Security process

9. Developers & site maintainers ● Follow Drupal APIs and best practices ● Take & verify backups ● Sanitize backups for sharing

10. Cross Site Scripting

11. Drupal 8 ● Twig as templating language – – ● WYSIWYG in core – – ● Automatically sanitizes strings on output No PHP in templates Streamlined filter mechanism (server and client side) No more full HTML as last resort Local image input filter – Only allow images from same site

12. Book on Security in Drupal

13. References ● DGD7 chapter 6 ● http://drupal.org/security ● http://www.drupalscout.com/ ● http://groups.drupal.org/best-practices-drupal-security

14. Thanks! ● Stéphane Corlosquet: – – – scorlosquet@gmail.com @scorlosquet http://openspring.net/

�ݺ�ߣ

Keeping your Drupal site secure 2013

Recommended

More Related Content

Similar to Keeping your Drupal site secure 2013 (20)

More from scorlosquet (15)

Recently uploaded (20)

Keeping your Drupal site secure 2013