Security Best Practices for Joomla Agencies

Joomla users tend to know a lot about securing their websites. But website security best practices is literally the tip of the web agency security pyramid. In this presentation, Victor will discuss the three levels of this pyramid. He will put website security in context with the other levels of security that are recommended for successful agencies that are highly trusted by their clients.

https://www.joomlashack.com/conference/

Transcript

1. Security Best Practices for Agencies
2. @VicDrover Panama Papers
3. @VicDrover Joomla implicated in data loss
4. @VicDrover Threats keep coming
5. @VicDrover JED Server Security Incident
6. @VicDrover Levels of website security
7. @VicDrover Levels of website security
8. @VicDrover Levels of website security
9. Client Passwords
11. @VicDrover Agency Passwords
13. @VicDrover Trust extends to your team
14. @VicDrover Email security
15. @VicDrover Staff
16. Staff
17. @VicDrover Disaster Response Plan
18. @VicDrover Initial response Who, What, When Emergency contact info Service provider info 1-time use passwords
19. Agency 7
20. Agency 7
21. @VicDrover Security policy Email usage Resource access Password strength Password duration Account sharing Team composition Disaster planning Continuing Education
22. @VicDrover Levels of website security Local Remote
23. @VicDrover Website: one piece of the puzzle
24. @VicDrover PHP Usage
25. @VicDrover Webserver security
26. @VicDrover Heartbleed
27. @VicDrover ssllabs.com/ssltest/ SSL Report: joomla.org
28. @VicDrover Let’s Encrypt
29. @VicDrover Other local issues SSH on non-default port, encryption keys Disable FTP Strong database password Enable logging Disable magic_quotes Disable register_globals
30. @VicDrover Levels of website security Local Remote
31. @VicDrover Remote services - email
32. @VicDrover Remote services - DNS
33. @VicDrover Remote services - reverse proxy
34. @VicDrover Remote services - reverse proxy
35. @VicDrover Levels of website security
36. @VicDrover Well-known Joomla best-practices Unique administrator account Disable guest registration Remove Joomla installation directory No FTP password storage Disable Error Reporting
37. @VicDrover YourSites MySites Best Practice Scanners
40. @VicDrover Enforce strong passwords
41. @VicDrover Password control
42. @VicDrover Password expiry
43. After activation you may login to your website using the following username and password:
45. @VicDrover Other site tips Prevention Software firewall (Admin Tools, RS Firewall) Protect admin areas with a password/token Don’t store credit card data locally Don’t share user accounts!!! Log User Activity
47. @VicDrover Apply update early & often