Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Drupal Security: What You Need to Know

Drupal Security: What You Need to Know

Keeping your website secure is important—but it isn't always easy. By shifting to a security-first mindset, you can rise to meet the challenge.

In this webinar, learn how to take immediate steps—some without touching a single line of code—to improve the security of your Drupal installation.

Presented at Mediacurrent

Mark Shropshire

March 25, 2021
Tweet

More Decks by Mark Shropshire

Other Decks in Technology

Transcript

  1. mÖũĴœĞũŋťŭĞĢũā ¢ČőıŚƀ͓$ıƀČÿƔŚƀ͓ŚĤ͓$ČƳČŇŚŽŏČőƔ ̴ıő̴ŏãƀńƈĬƀŚŽƈĬıƀČ ΎƈĬƀŚŽ Ɣ AƀŚŏ͓ŚőÿŚƀĆ̩͓kŚƀƔĬ͓ãƀŚŇıőã Ɣ ˠ˞ͳ͓ƺČãƀƈ͓ŚĤ͓ČƹŽČƀıČőÿČ͓ãƈ͓ã͓ƔČÿĬőıÿãŇ͓ƔČãŏ͓ŇČãĆČƀ Ɣ aŚƳČƈ͓ČŏŽŚƴČƀıőĥ͓ƔČãŏƈ͓ƔŚ͓ČƹÿČŇ͓ƴĬıŇČ͓Ɯƈıőĥ͓

    þČƈƔ͓ŚĤ͓ÿŇãƈƈ͓ŚŽČő͓ƈŚƜƀÿČ͓ƔČÿĬőŚŇŚĥƺ͓ƈŚŇƜƔıŚőƈ̮ Ɣ —ãƈƈıŚőãƔČ͓ãþŚƜƔ͓ŽČƀƈŚőãŇ͓ãőĆ͓ƔČãŏ͓ĥƀŚƴƔĬ͓ ƔĬƀŚƜĥĬ͓ŏČőƔŚƀƈĬıŽ̩͓ãŇıĥőıőĥ͓ıőĆıƳıĆƜãŇ͓ŽƜƀŽŚƈČ͓ ƴıƔĬ͓iČĆıãÿƜƀƀČőƔ͌ƈ͓ƳıƈıŚő Ɣ —Ňãƺƈ͓ƈãƹ̩͓ĆƀƜŏƈ̩͓ńČƺƈ̩͓ãőĆ͓þãƈƈ͓ãőĆ͓Ĭãƈ͓ã͓ŇıƈƔ͓ŚĤ͓ ŚƔĬČƀ͓ıőƈƔƀƜŏČőƔƈ͓ƔĬãƔ͓ĬČ͓ƴŚƜŇĆ͓ŇŚƳČ͓ƔŚ͓ŇČãƀő̫ œĴĢķķŭ Ɣ $ƀƜŽãŇ Ɣ ¢ČÿƜƀıƔƺ Ɣ $ČƳtŽƈ Ɣ AŇƜƔƔČƀ Ɣ ÿſƜıã͓¢ıƔČ͓AãÿƔŚƀƺ Ɣ aČãĆČƀƈĬıŽ
  2. œāóŽũĢŶƘ̖DĢũŭŶ ”ķÖłłĢłė Ɣ —ƀŚãÿƔıƳČ͓ãőĆ͓ÿŚŇŇãþŚƀãƔıƳČ ãŽŽƀŚãÿĬ͓ƴıƔĬ͓ƈƔãńČĬŚŇĆČƀƈ Ɣ aãƺČƀČĆ͓ĆČĤČőƈČ Ɣ ƀÿĬıƔČÿƔƜƀČ͓ƀČƳıČƴƈ Ɣ

    ŚĆČ͓ƀČƳıČƴƈ Ɣ ƜƔŚŏãƔČĆ͓ƔČƈƔıőĥ Ɣ ŚőƔıőƜŚƜƈ͓ıŏŽƀŚƳČŏČőƔƈ Ɣ ¢ČÿƜƀıƔƺ͓ãƜĆıƔƈ͓̻ŚőČ́Śljƈ͓ãőĆ͓ ŚőĥŚıőĥ̼ Ɣ $ŚÿƜŏČőƔãƔıŚő
  3. Ζ͓˟ˤ ¦ŋťːˏÂāðťťķĢóÖŶĢŋł œāóŽũĢŶƘ˜ĢŭĴŭ NőŁČÿƔıŚő ƀŚńČő͓ƜƔĬČőƔıÿãƔıŚő ¢ČőƈıƔıƳČ͓$ãƔã͓*ƹŽŚƈƜƀČ Óia͓*ƹƔČƀőãŇ͓*őƔıƔıČƈ͓̻ÓÓ*̼ ƀŚńČő͓ÿÿČƈƈ͓ŚőƔƀŚŇ ¢ČÿƜƀıƔƺ͓iıƈÿŚőnjĥƜƀãƔıŚő ƀŚƈƈ́¢ıƔČ͓¢ÿƀıŽƔıőĥ͓Ó¢¢

    NőƈČÿƜƀČ͓$ČƈČƀıãŇıDŽãƔıŚő ¶ƈıőĥ͓ŚŏŽŚőČőƔƈ͓ƴıƔĬ͓_őŚƴő͓ÍƜŇőČƀãþıŇıƔıČƈ NőƈƜNJÿıČőƔ͓aŚĥĥıőĥ͓Ώ͓iŚőıƔŚƀıőĥ ĬƔƔŽƈ̴̨ ̴ŚƴãƈŽ̮Śƀĥ̴ƴƴƴ́ŽƀŚŁČÿƔ́ƔŚŽ́ƔČő͓
  4. mŋùŽķā œāķāóŶĢŋł Ɣ iŚĆƜŇČ͓¶ƈãĥČ Ɣ NƈƈƜČ͓™ƜČƜČ͓ÿƔıƳıƔƺ Ɣ ¢ČÿƜƀıƔƺ Ɣ iãőƜãŇ͓šČƳıČƴ͓ãőĆ͓¯ČƈƔıőĥ

    Ɣ šČŇČãƈČ͓¢ƔãƔƜƈ Ɣ ŚŏŏıƔ͓ÿƔıƳıƔƺ Ɣ —ƀŚŁČÿƔ͓ıőĤŚƀŏãƔıŚő Ɣ šıƈń͓ƈƈČƈƈŏČőƔ Ɣ ČőČnjƔ ͓BƜıĆČ͓ƔŚ͓$ƀƜŽãŇ͓iŚĆƜŇČ͓*ƳãŇƜãƔıŚő
  5. mŋùŽķā ťÖŶóĞāŭ Ɣ ¢ŚŏČƔıŏČƈ̩͓ŽãƔÿĬČƈ͓ãƀČ͓ őČÿČƈƈãƀƺ Ɣ Ňƴãƺƈ͓ƈƜþŏıƔ͓ŽãƔÿĬČƈ͓ƔŚ͓ $ƀƜŽãŇ̮Śƀĥ Ɣ ¢ƜþŏıƔƔıőĥ͓ŽãƔÿĬČƈ͓ãŇŇŚƴƈ̨

    ż ƜƔŚŏãƔČĆ͓ƔČƈƔıőĥ͓ ż iãıőƔãıőČƀ͓ƀČƳıČƴ Ɣ —ãƔÿĬČƈ͓ÿƀČãƔČ̨͓ ż šČƳıƈıŚő͓ĬıƈƔŚƀƺ͓ ż ő͓ŚŽŽŚƀƔƜőıƔƺ͓ĤŚƀ͓ ÿŚŏŏƜőıƔƺ͓ıőŽƜƔ
  6. Ζ͓ˠ˟ 8KRKP\BYDU VFULSW!DOHUW $WWDFN VFULSW! pŋŶ¦ĞĢŭ˿ YDULDEOHV> WLWOH @ +HUH

    VDWLWOHP\BYDU RłŭŶāÖù̀ŶĞĢŭ˿ YDULDEOHV> WLWOH @ W +HUH VDWLWOH#WLWOH> #WLWOH  !P\BYDU@  ķŭŋŭāā ?'UXSDOWUDQVODWLRQ !IRUPDW3OXUDO Ŷ̒̓
  7. Ζ͓ˠˠ 8KRKP\BYDU VFULSW!DOHUW $WWDFN VFULSW! 2KQRP\BRWKHUBYDU GLY!VRPHXQH[SHFWHG+70/GLY! pŋŶ¦ĞĢŭ˿ YDULDEOHV> WLWOH

    @  S! P\BYDU S!  YDULDEOHV> ERG\ @ QRGH!JHW ERG\ !YDOXHP\BRWKHUBYDU RłŭŶāÖù̀ŶĞĢŭ˿ YDULDEOHV> WLWOH @ ;VVILOWHU P\BYDU  YDULDEOHV> ERG\ @ QRGH!JHW ERG\ !YDOXH+WPOHVFDSH P\BRWKHUBYDU  Çŭŭ˿˿ƩķŶāũ̒̓ÖłùNŶĿķ˿˿āŭóÖťā̒̓
  8. Ζ͓ˠˡ mŋłĢŶŋũ'ũŽťÖķ œāóŽũĢŶƘùƑĢŭŋũĢāŭ Ɣ $ƀƜŽãŇ͓ÿŚƀČ Ɣ $ƀƜŽãŇ͓ÿŚőƔƀıþ͓ŽƀŚŁČÿƔƈ Ɣ —ƜþŇıÿ͓ƈČƀƳıÿČ͓ãőőŚƜőÿČŏČőƔƈ Ɣ

    kŚƔınjÿãƔıŚőƈ͓Ƴıã͓ČŏãıŇ͓ãőĆ͓š¢¢ Ɣ AŚŇŇŚƴ͓ΎĆƀƜŽãŇƈČÿƜƀıƔƺ͓Śő͓¯ƴıƔƔČƀ Ɣ $ƀƜŽãŇ͓¢Ňãÿń͓̭ƈČÿƜƀıƔƺ́ſƜČƈƔıŚőƈ Ɣ šČãĆ͓¢͓ĆŚÿƜŏČőƔãƔıŚő ĬƔƔŽƈ̴̨ ̴ƴƴƴ̮ĆƀƜŽãŇ̮Śƀĥ̴ƈČÿƜƀıƔƺ͓
  9. Ζ͓ˠˢ 8KRKP\BYDU  6(/(&7 )520SULYDWHBGDWD DVDWWDFN pŋŶŶĞĢŭ˿ ?'UXSDOGDWDEDVH !TXHU\ 6(/(&7

    )520QRGHBILHOGBGDWD P\BYDU  RłŭŶāÖù̀ŶĞĢŭ˿ %HWWHU ?'UXSDOGDWDEDVH !VHOHFW QRGHBILHOGBGDWD  G !ILHOGV G >@ !FRQGLWLRQ GQLG P\BYDU  ˼'ũŽťÖķ˿ùÖŶÖðÖŭā̒̓ %HWWHU\HW ?'UXSDOHQWLW\7\SH0DQDJHU JHW6WRUDJH QRGH !JHW4XHU\ !FRQGLWLRQ QLG P\BYDU 
  10. Ζ͓ˠˣ pŋŶŶĞĢŭ˿ SXEOLFIXQFWLRQP\&RQWUROOHU%XLOG QLG ^  QRGH WKLV!HQWLW\7\SH0DQDJHU !JHW6WRUDJH QRGH

    !ORDG QLG   EXLOG> QRGH @ QRGH!YLHZ  UHWXUQEXLOG ` !ŋłŶũŋķķāũŭ RłŭŶāÖù̀ŶĞĢŭ˿ SXEOLFIXQFWLRQP\&RQWUROOHU%XLOG QLG ^  QRGH WKLV!HQWLW\7\SH0DQDJHU !JHW6WRUDJH QRGH !ORDG QLG   LI QRGH!DFFHVV YLHZ WKLV!FXUUHQW8VHU ^ EXLOG> QRGH @ QRGH!YLHZ  ` UHWXUQEXLOG `