Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Sleep Better at Night with a Secure Drupal Site

Sleep Better at Night with a Secure Drupal Site

Are you losing sleep, worrying about your Drupal site’s security? That isn’t healthy! With Drupal being used for building websites and applications in government, non-profits, higher education, and corporate enterprises, it is important to make sure that projects follow regulatory and organizational security controls. Are you ready to learn how to take immediate steps to improve the security of your Drupal installation? Great, let’s get get started.

This session will provide the details you need to create a security-first plan to enhance Drupal’s strong security foundation with community-contributed modules. Attendees will learn how to leverage these community contributions to ensure Drupal’s ability to provide confidentiality, integrity, and availability for your users.

Drupal core and contributed module security enhancements will be demonstrated live. These demonstrations will show how to address many of the concerns listed in the globally recognized OWASP Top 10 Web Application Security Risks document. In addition, attendees will learn how to keep up with official security announcements from the Drupal Security Team, understand Drupal security advisories, and find resources to learn more about Drupal security.

Security risks and improvements covered

Attack surface reduction
Broken Access Control
Cross-Site Scripting XSS
Insufficient logging & monitoring
Password policies
Security misconfiguration
Using components with known vulnerabilities

Presented by shrop at BADCamp 2020

66915a7bf21d69f3ec3207fd9c493504?s=128

Mark Shropshire

October 17, 2020
Tweet

Transcript

  1. œķāāťāŶŶāũÖŶpĢėĞŶ ƒĢŶĞÖœāóŽũā'ũŽťÖķœĢŶā tÿƔŚþČƀ͓˟˥̩͓ˠ˞ˠ˞

  2. ˟̮ ÎĬãƔ͌ƈ͓¢ČÿƜƀıƔƺ́AıƀƈƔ̯ ˠ̮ ¢ČÿƜƀıƔƺ͓ãőĆ͓¯ĬČ͓$ƀƜŽãŇ͓ŚŏŏƜőıƔƺ ˡ̮ t΢—͓¯ŚŽ͓˟˞͓ÎČþ͓ÍƜŇőČƀãþıŇıƔıČƈ ˢ̮ $ƀƜŽãŇ͓ČƈƔ͓—ƀãÿƔıÿČƈ͓ãőĆ͓¢ŚŇƜƔıŚőƈ ˣ̮ ™Ώ

    ¦ŋùÖƘ̗ŭ ėāłùÖ
  3. mÖũĴœĞũŋťŭĞĢũā ¢ČőıŚƀ͓$ıƀČÿƔŚƀ͓ŚĤ͓$ČƳČŇŚŽŏČőƔ ̴ıő̴ŏãƀńƈĬƀŚŽƈĬıƀČ ΎƈĬƀŚŽ Ɣ AƀŚŏ͓ŚőÿŚƀĆ̩͓kŚƀƔĬ͓ãƀŚŇıőã Ɣ ˠ˞ͳ͓ƺČãƀƈ͓ŚĤ͓ČƹŽČƀıČőÿČ͓ãƈ͓ã͓ƔČÿĬőıÿãŇ͓ƔČãŏ͓ŇČãĆČƀ Ɣ aŚƳČƈ͓ČŏŽŚƴČƀıőĥ͓ƔČãŏƈ͓ƔŚ͓ČƹÿČŇ͓ƴĬıŇČ͓Ɯƈıőĥ͓

    þČƈƔ͓ŚĤ͓ÿŇãƈƈ͓ŚŽČő͓ƈŚƜƀÿČ͓ƔČÿĬőŚŇŚĥƺ͓ƈŚŇƜƔıŚőƈ̮ Ɣ —ãƈƈıŚőãƔČ͓ãþŚƜƔ͓ŽČƀƈŚőãŇ͓ãőĆ͓ƔČãŏ͓ĥƀŚƴƔĬ͓ ƔĬƀŚƜĥĬ͓ŏČőƔŚƀƈĬıŽ̩͓ãŇıĥőıőĥ͓ıőĆıƳıĆƜãŇ͓ŽƜƀŽŚƈČ͓ ƴıƔĬ͓iČĆıãÿƜƀƀČőƔ͌ƈ͓ƳıƈıŚő Ɣ —Ňãƺƈ͓ƈãƹ̩͓ĆƀƜŏƈ̩͓ńČƺƈ̩͓ãőĆ͓þãƈƈ͓ãőĆ͓Ĭãƈ͓ã͓ŇıƈƔ͓ŚĤ͓ ŚƔĬČƀ͓ıőƈƔƀƜŏČőƔƈ͓ƔĬãƔ͓ĬČ͓ƴŚƜŇĆ͓ŇŚƳČ͓ƔŚ͓ŇČãƀő̫ œĴĢķķŭ Ɣ $ƀƜŽãŇ Ɣ ¢ČÿƜƀıƔƺ Ɣ $ČƳtŽƈ Ɣ AŇƜƔƔČƀ Ɣ ÿſƜıã͓¢ıƔČ͓AãÿƔŚƀƺ Ɣ aČãĆČƀƈĬıŽ
  4. zťāłœŋŽũóā 1ƗťÖłŭĢŋł”ÖũŶłāũ

  5. ¯Ś͓þƀıőĥ͓ƔŚĥČƔĬČƀ͓ƔĬČ͓ŏŚƈƔ͓ƔãŇČőƔČĆ͓ƔČãŏ͓ŏČŏþČƀƈ͓ ƔŚ͓ŽƀŚƳıĆČ͓ƴŚƀŇĆ́ÿŇãƈƈ͓ƈŚŇƜƔıŚőƈ͓ĤŚƀ͓ƔĬČ͓ƴČþ̮ zŽũmĢŭŭĢŋł

  6. ÂĞÖŶ̗ŭœāóŽũĢŶƘ̌DĢũŭŶ˽

  7. Ζ͓˥ ÂĞÖŶ̗ŭœāóŽũĢŶƘ̌DĢũŭŶ˽ ¢ČÿƜƀıƔƺ́njƀƈƔ͓ŏČãőƈ͓ĥŚıőĥ͓þČƺŚőĆ͓ÿŚŏŽŇıãőÿČ͓ƔŚ͓ãƈƈČƈƈ͓ƀıƈń̮͓NƔ͌ƈ͓þŚƔĬ ã͓ÿƜŇƔƜƀãŇ͓ŏıőĆƈČƔ͓ãőĆ͓ã͓ÿŚőƔıőƜŚƜƈ͓ĆČƳČŇŚŽŏČőƔ͓㎎ƀŚãÿĬ͓ƔĬãƔ͌ƈ ƀŚŚƔČĆ͓ıő͓ŽƀŚÿČƈƈ͓ãƜƔŚŏãƔıŚő̮

  8. œāóŽũĢŶƘ̌DĢũŭŶ ”ķÖłłĢłė Ɣ —ƀŚãÿƔıƳČ͓ãőĆ͓ÿŚŇŇãþŚƀãƔıƳČ͓ ㎎ƀŚãÿĬ͓ƴıƔĬ͓ƈƔãńČĬŚŇĆČƀƈ Ɣ aãƺČƀČĆ͓ĆČĤČőƈČ Ɣ ƀÿĬıƔČÿƔƜƀČ͓ƀČƳıČƴƈ Ɣ

    ŚĆČ͓ƀČƳıČƴƈ Ɣ ƜƔŚŏãƔČĆ͓ƔČƈƔıőĥ Ɣ ŚőƔıőƜŚƜƈ͓ıŏŽƀŚƳČŏČőƔƈ Ɣ ¢ČÿƜƀıƔƺ͓ãƜĆıƔƈ͓̻ŚőČ́Śljƈ͓ãőĆ͓ ŚőĥŚıőĥ̼ Ɣ $ŚÿƜŏČőƔãƔıŚő
  9. Ζ͓˧ 'ĢŭóŋƑāũƘ 'āŭĢėł 'āƑāķŋťĿāłŶ —ŽÖķĢŶƘ ŭŭŽũÖłóā 'āťķŋƘĿāłŶ œŽťťŋũŶ $ıĥıƔãŇ͓ƈƔƀãƔČĥƺ ÎıƀČĤƀãŏČƈ͓

    ¯ČÿĬőıÿãŇ͓ ƀÿĬıƔČÿƔƜƀČ͓Ώ͓ AƜőÿƔıŚőãŇ͓¢ŽČÿƈ ™ƜãŇıƔƺ͓ƈƈƜƀãőÿČ ¯ČƈƔ͓ãƈČƈ šČ́ČƈƔıŏãƔČ͓¢ÿŚŽČ͓ ŚĤ͓ÎŚƀń ¢ƔƺŇČ͓¯ıŇČƈ iŚŚĆ͓ŚãƀĆƈ šČƈŽŚőƈıƳČ͓$Čƈıĥő͓ ¯ČŏŽŇãƔČƈ I¯ia͓—ƀŚƔŚƔƺŽČƈ iŚĆƜŇČ͓ ŚőnjĥƜƀãƔıŚő ƜƈƔŚŏ͓iŚĆƜŇČ͓ —ƀŚĥƀãŏŏıőĥ ƜƈƔŚŏ͓¯ĬČŏČ͓ $ČƳČŇŚŽŏČőƔ AƀŚőƔ́*őĆ͓ AƀãŏČƴŚƀń͓ NŏŽŇČŏČőƔãƔıŚő *ƹČÿƜƔČ͓AıƀƈƔ͓¯ČƈƔ͓ šƜőƈ ¶ƈČƀ͓ÿÿČŽƔãőÿČ͓ ¯ČƈƔıőĥ͓̻¶¯̼ *ƹČÿƜƔČ͓AıőãŇ͓¯ČƈƔ͓ šƜő —ƀČŽãƀČ͓ —ƀŚĆƜÿƔıŚő͓ *őƳıƀŚőŏČőƔ ¢ƺőÿ͓aãƔČƈƔ͓AıŇČƈ͓ ãőĆ͓$ãƔã AıőãŇıDŽČ͓ãÿĬČ͓ ¢ČƔƔıőĥƈ ¢ƴıƔÿĬ͓$k¢ őãŇƺƔıÿƈ̴ —ČƀĤŚƀŏãőÿČ͓ *ƳãŇƜãƔıŚő AČãƔƜƀČ͓ *őĬãőÿČŏČőƔƈ iŚĆƜŇČ͓¶ŽĆãƔČƈ ̴͓¯ČƈƔıőĥ œāóŽũĢŶƘ¦ĞũŋŽėĞŋŽŶŶĞāÂāðŭĢŶā”ũŋóāŭŭ
  10. œāóŽũĢŶƘÖłù¦Ğā 'ũŽťÖķ!ŋĿĿŽłĢŶƘ

  11. 'ũŽťÖķœāóŽũĢŶƘ¦āÖĿ Ɣ šČƈŚŇƳČƈ͓ƀČŽŚƀƔČĆ͓ƈČÿƜƀıƔƺ͓ıƈƈƜČƈ͓ıő͓¢ČÿƜƀıƔƺ͓ĆƳıƈŚƀıČƈ Ɣ —ƀŚƳıĆČƈ͓ãƈƈıƈƔãőÿČ͓ĤŚƀ͓ÿŚőƔƀıþƜƔČĆ͓ŏŚĆƜŇČ͓ŏãıőƔãıőČƀƈ͓ ıő͓ƀČƈŚŇƳıőĥ͓ƈČÿƜƀıƔƺ͓ıƈƈƜČƈ Ɣ —ƀŚƳıĆČƈ͓ĆŚÿƜŏČőƔãƔıŚő͓Śő͓ĬŚƴ͓ƔŚ͓ƴƀıƔČ͓ƈČÿƜƀČ͓ÿŚĆČ Ɣ —ƀŚƳıĆČƈ͓ĆŚÿƜŏČőƔãƔıŚő͓Śő͓ƈČÿƜƀıőĥ͓ƺŚƜƀ͓ƈıƔČ

    Ɣ IČŇŽ͓ƔĬČ͓ıőĤƀãƈƔƀƜÿƔƜƀČ͓ƔČãŏ͓ƔŚ͓ńČČŽ͓ƔĬČ͓ĆƀƜŽãŇ̮Śƀĥ͓ ƈČÿƜƀČ ĬƔƔŽƈ̴̨ ̴ƴƴƴ̮ĆƀƜŽãŇ̮Śƀĥ̴ƈČÿƜƀıƔƺ́ƔČãŏ
  12. BƜãƀĆƀ͓ıƈ͓ã͓$ƀƜŽãŇ͓ĆıƈƔƀıþƜƔıŚő͓ƴıƔĬ͓ã͓ ÿŚŏþıőãƔıŚő͓ŚĤ͓ŏŚĆƜŇČƈ͓ãőĆ͓ƈČƔƔıőĥƈ͓ƔŚ͓ ČőĬãőÿČ͓ã͓$ƀƜŽãŇ͓㎎ŇıÿãƔıŚő̲ƈ͓ƈČÿƜƀıƔƺ͓ ãőĆ͓ãƳãıŇãþıŇıƔƺ͓ƔŚ͓ŏČČƔ͓ČőƔČƀŽƀıƈČ͓ƈČÿƜƀıƔƺ͓ ƀČſƜıƀČŏČőƔƈ̮ BƜãƀĆƀ͓ıőÿŚƀŽŚƀãƔČƈ͓ıőĆƜƈƔƀƺ͓þČƈƔ͓ ŽƀãÿƔıÿČƈ͓ĤƀŚŏ͓ƈČÿƜƀıƔƺ͓ƈƔãőĆãƀĆƈ̩͓ ƀČĥƜŇãƔŚƀƺ͓ÿŚőƔƀŚŇƈ̩͓ãőĆ͓ƈČÿƜƀıƔƺ͓ ÿČƀƔınjÿãƔıŚőƈ̮ ĬƔƔŽƈ̴̨

    ̴ĆƀƜŽãŇ̮Śƀĥ̴ŽƀŚŁČÿƔ̴ĥƜãƀĆƀ͓ $ƀƜŽãŇ͓¢Ňãÿń̨͓̭ÿŚőƔƀıþ́ĥƜãƀĆƀ
  13. zÂœ”¦ŋťːˏÂāð ÁŽķłāũÖðĢķĢŶĢāŭ

  14. Ζ͓˟ˢ ¦ŋťːˏÂāðťťķĢóÖŶĢŋł œāóŽũĢŶƘ˜ĢŭĴŭ NőŁČÿƔıŚő ƀŚńČő͓ƜƔĬČőƔıÿãƔıŚő ¢ČőƈıƔıƳČ͓$ãƔã͓*ƹŽŚƈƜƀČ Óia͓*ƹƔČƀőãŇ͓*őƔıƔıČƈ͓̻ÓÓ*̼ ƀŚńČő͓ÿÿČƈƈ͓ŚőƔƀŚŇ ¢ČÿƜƀıƔƺ͓iıƈÿŚőnjĥƜƀãƔıŚő ƀŚƈƈ́¢ıƔČ͓¢ÿƀıŽƔıőĥ͓Ó¢¢

    NőƈČÿƜƀČ͓$ČƈČƀıãŇıDŽãƔıŚő ¶ƈıőĥ͓ŚŏŽŚőČőƔƈ͓ƴıƔĬ͓_őŚƴő͓ÍƜŇőČƀãþıŇıƔıČƈ NőƈƜNJÿıČőƔ͓aŚĥĥıőĥ͓Ώ͓iŚőıƔŚƀıőĥ ĬƔƔŽƈ̴̨ ̴ŚƴãƈŽ̮Śƀĥ̴ƴƴƴ́ŽƀŚŁČÿƔ́ƔŚŽ́ƔČő͓
  15. 'ũŽťÖķāŭŶ”ũÖóŶĢóāŭ ÖłùœŋķŽŶĢŋłŭ

  16. mŋùŽķā œāķāóŶĢŋł Ɣ iŚĆƜŇČ͓¶ƈãĥČ Ɣ NƈƈƜČ͓™ƜČƜČ͓ÿƔıƳıƔƺ Ɣ ¢ČÿƜƀıƔƺ Ɣ iãőƜãŇ͓šČƳıČƴ͓ãőĆ͓¯ČƈƔıőĥ

    Ɣ šČŇČãƈČ͓¢ƔãƔƜƈ Ɣ ŚŏŏıƔ͓ÿƔıƳıƔƺ Ɣ —ƀŚŁČÿƔ͓ıőĤŚƀŏãƔıŚő Ɣ šıƈń͓ƈƈČƈƈŏČőƔ Ɣ ČőČnjƔ ͓BƜıĆČ͓ƔŚ͓$ƀƜŽãŇ͓iŚĆƜŇČ͓*ƳãŇƜãƔıŚő
  17. ­ŭā'ũŽťÖķ”Rŭ ¶ƈČ͓$ƀƜŽãŇ͓—Nƈ͓ƔŚ͓ƈČÿƜƀČ͓ƺŚƜƀ͓ÿŚőƔƀıþ͓ãőĆ͓ÿƜƈƔŚŏ͓ÿŚĆČ̮ ĬƔƔŽƈ̴̨ ̴ãŽı̮ĆƀƜŽãŇ̮Śƀĥ̴ãŽı̴ĆƀƜŽãŇ͓ ÎƀıƔıőĥ͓ƈČÿƜƀČ͓ÿŚĆČ͓ĤŚƀ͓$ƀƜŽãŇ

  18. Ζ͓˟˦ mŋłĢŶŋũ'ũŽťÖķ œāóŽũĢŶƘùƑĢŭŋũĢāŭ Ɣ $ƀƜŽãŇ͓ÿŚƀČ Ɣ $ƀƜŽãŇ͓ÿŚőƔƀıþ͓ŽƀŚŁČÿƔƈ Ɣ —ƜþŇıÿ͓ƈČƀƳıÿČ͓ãőőŚƜőÿČŏČőƔƈ Ɣ

    kŚƔınjÿãƔıŚőƈ͓Ƴıã͓ČŏãıŇ͓ãőĆ͓š¢¢ Ɣ AŚŇŇŚƴ͓ΎĆƀƜŽãŇƈČÿƜƀıƔƺ͓Śő͓¯ƴıƔƔČƀ Ɣ $ƀƜŽãŇ͓¢Ňãÿń͓̭ƈČÿƜƀıƔƺ́ſƜČƈƔıŚőƈ Ɣ šČãĆ͓¢͓ĆŚÿƜŏČőƔãƔıŚő ĬƔƔŽƈ̴̨ ̴ƴƴƴ̮ĆƀƜŽãŇ̮Śƀĥ̴ƈČÿƜƀıƔƺ͓
  19. Ζ͓˟˧ ŽŶŋĿÖŶāù¦āŭŶĢłė !ŋłŶĢłŽŋŽŭRłŶāėũÖŶĢŋł1ƗÖĿťķāŭ Ɣ ĆƀƜƈĬ͓Žǫ̆ƈČÿƜƀıƔƺ Ɣ ¢ČÿƜƀıƔƺ͓šČƳıČƴ Ɣ t΢—͓ÞãŽ͓ãƈČŇıőČ͓¢ÿãő iČĆıãÿƜƀƀČőƔ͓ıƔþƜÿńČƔ͓—ıŽČŇıőČƈ

  20. 'āĿŋŭ Ɣ $ƀƜŽãŇ͓ŽƀŚŁČÿƔ͓ŽãĥČ Ɣ ¢ČÿƜƀıƔƺ͓ĆƳıƈŚƀıČƈ Ɣ ƔƔãÿń͓ƈƜƀĤãÿČ͓ƀČĆƜÿƔıŚő Ɣ ƀŚńČő͓ÿÿČƈƈ͓ŚőƔƀŚŇ Ɣ

    ƀŚƈƈ́¢ıƔČ͓¢ÿƀıŽƔıőĥ͓Ó¢¢ Ɣ NőƈƜNJÿıČőƔ͓ŇŚĥĥıőĥ͓Ώ͓ ŏŚőıƔŚƀıőĥ Ɣ —ãƈƈƴŚƀĆ͓ŽŚŇıÿıČƈ Ɣ ¢ČÿƜƀıƔƺ͓ŏıƈÿŚőnjĥƜƀãƔıŚő Ɣ ¶ƈıőĥ͓ÿŚŏŽŚőČőƔƈ͓ƴıƔĬ͓ ńőŚƴő͓ƳƜŇőČƀãþıŇıƔıČƈ
  21. Ζ͓ˠ˟ ÎĬãƔ͌ƈ͓ıőƈıĆČ̨ Ɣ ¯ĬƀČČ͓ĤŚƜőĆãƔıŚőƈ͓ĤŚƀ͓ŏãıőƔãıőıőĥ͓ãőĆ͓ƈČÿƜƀıőĥ͓ƺŚƜƀ͓ƴČþƈıƔČ͓ ãőĆ͓ƔČÿĬ͓ƈƔãÿń Ɣ ĬČÿńŇıƈƔ͓ƔŚ͓ĆČnjőČ͓ã͓ƈČÿƜƀıƔƺ͓ŽŚŇıÿƺ͓ĤŚƀ͓ƺŚƜƀ͓ƔČãŏ Ɣ IŚƴ͓ƔŚ͓ŏŚőıƔŚƀ͓ĤŚƀ͓$ƀƜŽãŇ͓ãőĆ͓ÎŚƀƗƀČƈƈ͓ƈČÿƜƀıƔƺ͓ƀČŇČãƈČƈ Ɣ

    ¢ČÿƜƀıƔƺ͓ıőÿıĆČőƔ͓ƀČƈŽŚőƈČ͓ƀČŽŚƀƔ͓̻ĤƀČČ͓ƔČŏŽŇãƔČ̼ ĬƔƔŽƈ̴̨ ̴ƴƴƴ̮ŏČĆıãÿƜƀƀČőƔ̮ÿŚŏ̴ČþŚŚńƈ̴ÿŏŚƈ́ĥƜıĆČ́ŚŽČő́ƈŚƜƀ ÿČ́ƈČÿƜƀıƔƺ͓ œāóŽũāƘŋŽũŋťāłŭŋŽũóā̌ðÖŭāùĿÖũŶāóĞŭŶÖóĴƒĢŶĞ ŶĞĢŭũāŭŋŽũóāĕŋũðāŭŶťũÖóŶĢóāŭ˼ !mz̗ŭFŽĢùāŶŋzťāłœŋŽũóāœāóŽũĢŶƘ
  22. ¯Ĭãőń͓ƺŚƜ̫͓šČãÿĬ͓ŚƜƔ͓ƴıƔĬ͓ãőƺ͓ſƜČƈƔıŚőƈ̫ ŏČĆıãÿƜƀƀČőƔ̮ÿŚŏ̴ÿŚőƔãÿƔ́Ɯƈ ŏČĆıãÿƜƀƀČőƔ̮ÿŚŏ̴ƈČÿƜƀıƔƺ —͢

  23. ΎiČĆıãÿƜƀƀČőƔ iČĆıãÿƜƀƀČőƔ ΎiČĆıãÿƜƀƀČőƔ iČĆıãÿƜƀƀČőƔ$ƀƜŽãŇ iČĆıãÿƜƀƀČőƔ̮ÿŚŏ ΎiČĆıãÿƜƀƀČőƔ ¦ĞÖłĴÈŋŽ˸