0

I'm looking for information on Drupal's security processes, any audits carried out, benchmarking against securty standards, what happens security-wise before a new Drupal release etc...

The most useful info i have found thus far is here:

http://drupalsecurityreport.org/

and here:

https://www.drupal.org/security-team

But it doesn't give much detail on internal processes or on accreditations etc.

Danny.

Improve this question
5
  • If you have a specific question, you are more than welcome to ask. But questions without such specific point are often discouraged in stack exchange sites. The security team is quite friendly and responsive from what I have experienced. If you are a law firm or something like that, you will get a response quite quickly by contacting them directly.
    – AKS
    Mar 12, 2016 at 5:54
  • Not a law firm, a developer who's client has given me a long IT security questionnaire that asks the specific questions above. Can't find any detailed information online so 'Drupal Answers' seems like a good place to come. Honestly, the amount of 'we don't answer those kind of questions around here' responses this forum generates is incredible.
    – Danny Browne
    Mar 12, 2016 at 9:55
  • It's true. I didn't make the rules and the entire SE network is like that. I would love to comment on questions I can if you post them on r/Drupal on reddit or the Drupal.org forum and post link here.
    – AKS
    Mar 12, 2016 at 10:03
  • @DannyBrowne That tends to be the problem - people think this (Drupal Answers) is a forum, when it's anything but. It's easy to mistake for a forum, that's understandable; lists of questions, a text box to submit a post, somewhere to reply, comments, etc. But our format and requirements are very different. Regardless of whether or not we're militant about actually closing questions that are deemed off topic (which I'm afraid this post does fall under), people don't come here to help with the broader, discursive topics - they're here for the bitesized chunks. Hope that helps to explain it a bit
    – Clive ♦
    Apr 26, 2016 at 17:21
  • @Clive That's fair enough and does help clarify. First time anyone has cleared that up for me and I've just removed another potentially offending post. I would suggest strongly however that this be clearly communicated to new users. If anything it's a fairly simple UX failure fixed with a bit of time spent tweaking messaging throughout the site. (aware this might be complicated by stack exchange but there is always a way)
    – Danny Browne
    Apr 26, 2016 at 18:18

1 Answer 1

Reset to default
1

There are 2 websites you should look at, http://buytaert.net/greg-knaddison-and-drupal-security and http://crackingdrupal.com.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.