Building Secure and Available Drupal Applications with Guardr

66915a7bf21d69f3ec3207fd9c493504?s=47 shrop
August 13, 2016

Building Secure and Available Drupal Applications with Guardr

Guardr is a Drupal distribution with a combination of modules and settings to enhance a Drupal application's security and availability to meet enterprise security requirements. Presentation attendees will learn about Guardr's philosophy, features, and how to start new projects with Guardr.

First presented at Drupal Camp Asheville 2016

66915a7bf21d69f3ec3207fd9c493504?s=128

shrop

August 13, 2016
Tweet

Transcript

  1. 2.

    Intros 2 Mark Shropshire (shrop) @shrop Mark brings 20 years

    of experience leading technical teams to his role as Mediacurrent’s Open Source Security Lead. He is a leader in tech community organizing, blogging, podcasting, and public speaking within the Drupal community. Mark is passionate about architecting systems to solve workflow problems and improve efficiencies using open source software. Mark is the maintainer of the Gaurdr Drupal security module suite. Over his 20 year career leading technical teams, Mark gained experience in IT roles at a large urban research university and nationally recognized, award winning graphic communications company. Open Source Security Lead /in/markshropshire
  2. 3.

    About 3 Mediacurrent helps organizations build highly impactful, elegantly designed

    Drupal websites that achieve the strategic results they need. • Single-source provider • Specializing in Drupal since 2007 • Headquartered in Atlanta, GA • Team of 60+ Drupal Experts including development, design and strategy • Clients include: Large Enterprise and high-profile global brands
  3. 6.

    6 What is a Drupal distribution? Distributions are full copies

    of Drupal that include Drupal Core, along with additional software such as themes, modules, libraries, and installation profiles. https://www.drupal.org/documentation/build/distributions What is Guardr?
  4. 7.

    7 Drupal security distribution Guardr is a Drupal distribution with

    a combination of modules and settings to enhance a Drupal application's security and availability to meet enterprise security requirements. https://drupal.org/project/guardr What is Guardr?
  5. 8.

    8 Philosophy Guardr follows the CIA information security triad: confidentiality,

    integrity and availability. From Wikipedia: For any information system to serve its purpose, the information must be available when it is needed. This means that the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly. High availability systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades. https://en.wikipedia.org/wiki/Information_security#Key_concepts What is Guardr?
  6. 9.

    Guardr for Drupal 8 ★ Composer based for building install

    and updates ★ Packagist support ★ Currently in development release 9 Guardr for Drupal 7 ★ Drush make based building install ★ Profiler for sub-install profiles ★ Stable release
  7. 11.

    “If you spend more on coffee than on IT security,

    you will be hacked. What’s more, you deserve to be hacked. — Richard Clarke The key to social engineering is influencing a person to do something that allows the hacker to gain access to information or your network. — Kevin Mitnick
  8. 12.

    Security is always excessive until it's not enough. — Robbie

    Sinclair, Head of Security, Country Energy, NSW Australia “The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards.” — Gene Spafford
  9. 13.

    13 Isn’t Drupal secure? Drupal continues to improve, but no

    system is 100% secure. Guardr hardens Drupal. Q A Why Guardr?
  10. 14.

    14 Users, system complexity, and the balance between security and

    usability make infosec very challenging. Why Guardr?
  11. 15.

    15 Guardr incorporates industry best practices from security standards, regulatory

    controls, and security certifications. Why Guardr? PCI DSS ISO/IEC 27001 CISSP FERPA HIPAA
  12. 16.

    16 Why Guardr? Twig template engine (Prevents SQL injection and

    XSS) Drupal 8 Security Improved session ID and user session management CSRF token protection for the routing system Default clickjacking prevention PHP can only send one query to MySQL at a time (Prevents SQL injection) Configurable trust host patterns (Protects HTTP HOST Header attacks)
  13. 17.
  14. 19.

    Demos 19 • $ drush --no-patch-txt make build-guardr.make web •

    $ drush qd --root=web --use-existing --profile=guardr --watchdog --yes Build and install Guardr for Drupal 7
  15. 21.

    Demos 21 • $ composer install • $ cd web

    • $ drush qd --root=./ --use-existing --profile=guardr --watchdog --yes Build and install Guardr for Drupal 8
  16. 23.

    23 A big thanks to all of the Guardr contributors

    and supporting organizations. Credit: CC Image courtesy of pdjohnson on Flickr Get involved!
  17. 24.

    Get involved 24 • Writing documentation • Support Guardr users

    on Drupal 7 and/or Drupal 8 • Testing patches and updates • Developing new features and updates How can I help?
  18. 25.

    Get involved 25 • The issue queue! https://www.drupal.org/project/issues/guardr • Join

    our Slack group: http://guardr-slack-invites.herokuapp.com • Drupal.org - Ways to get involved: https://www.drupal.org/contribute • Join the Drupal security team: https://security.drupal.org/join How can I get involved?