2

I want to respond to this:

"Drupal is listed as limited use, not generally available because of the licensing and security issues related to various modules that people want to use."

I have two questions:

  1. Is Drupal less secure than other web solutions?
  2. Can contributed modules (i.e. modules that are accepted into the Drupal community) make Drupal less secure?
1
  • 6
    1.. No. 2.. Yes.
    – Jimajamma
    Nov 7, 2013 at 21:23

3 Answers 3

7

I'll start with your second question, "do contributed modules make Drupal less secure?"

In general, yes, because contributed modules expand the attack surface of your site. When a module provides user interaction features it's another point an attacker could probe for exploits on your site. Additionally that module becomes another dependency in your system and that affects site maintenance and agility.

Now, not all contributed modules are the same, they don't all provide user-facing functionality, but the point is that most every additional module has to be balanced with the possible risks that come along, including possible vulnerabilities.

Also, Gareth Parker correctly highlights that contributed modules undergo far less peer-review and testing than Drupal core, so there could be greater likelihood of security risks in the code. Again, it depends on the modules.

As for your first and main question, "is Drupal secure?". As one of the authors of the Drupal Security Report which attempts to answer this question by analyzing Drupal's published Security Advisories as well as describing how Drupal addresses the OWASP Top 10, I would say "yes" :) Full disclosure, I'm also a member of the Drupal security team.

However, there will be vulnerabilities found in Drupal in the future, it's not secure in that it's immune to risk. It's secure in that it's been both professionally reviewed by security firms and peer-reviewed by thousands of contributors during its development. Additionally, core APIs are strong, providing security mitigation techniques and tools, and many of the default configurations are secure.

1

Drupal Core itself is fairly secure as long as you keep it up to date. There's no way to say that it's perfect, but I wouldn't worry about security

Drupal Modules on the other hand are written by average people who simply want a piece of functionality, create it and then share it. Some projects have many people working on it, some have only one. These modules aren't checked by any kind of Drupal Team for security problems, so it's mainly on the people who make and contribute to them to make sure that it's all secure

Knowing that, it's easy to determine that some modules would be secure, some wouldn't, and it really varies from module to module. So in a long, roundabout way, yes, the modules can make drupal less secure

2
  • 2
    For new project contributions to drupal.org there is a small amount of security review that happens. The project application process (documented at drupal.org/node/1011698) contains some automated security analysis tools. Additionally manual peer review often happens as part of the application process.
    – bjeavons
    Nov 7, 2013 at 23:53
  • 1
    I stand corrected Nov 8, 2013 at 0:05
0

In my opinion drupal is secure in the general sense but like any other system there are, sometimes, security issues. However, Drupal has a large community and is opensource so the code is examined over and over by a large number of developers. When security issues are found, they're reported and made public so you can take precautionary measures until a patch is available.
You can check the following security advisory to get an idea how often security issues surface. I advise you to bookmark this page.

1
  • 3
    A minor correction, security issues are not made public when found. Issues are only public when there's an accompanying Security Advisory and new release of the software. Security issues should be communicated privately to the Drupal security team. This process is documented here drupal.org/security-team
    – bjeavons
    Nov 7, 2013 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.