6

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal site, I want to be certain that it is as secure as possible. I have completed as many proactive security measures as possible, including following the secure configuration and the best security practices guides on drupal.org, I've subscribed to the security newsgroup, and hardened the LAMP server using industry best practices.

Now that I have completed due diligence with regards to proactive security, I want to run a security audit before we go live to be able to generate a report stating we are "as secure as possible" for management. I usually do all of the testing by hand, page-by-page, using the OWASP Web App testing cheatsheet; however, I'm new to Drupal, this site is hundreds of pages, and I have limited time.

What are your recommendations for security testing a Drupal site of this size? I have access to Rapid7's Nexpose Enterprise, so I will be using that for some automated testing. I do not want to use hosted scanning tools, but will consider security-audited tools that I can install myself to use. Do you have security checklists you go by, similar to OWASP, but specific to Drupal 7? Any other advice for things I might have missed are also appreciated!

1
  • 2
    You'll always need to define specific tests to comply with your internal security standards, of course, but for general things there's the Security Review module. The specific tests will obviously vary wildly depending on what modules and configurations you're using. Apart from the obvious xss/injection attacks what you're testing for will depend on what a module is supposed to do, and how it interacts with core and other modules in the system
    – Clive
    Commented Jan 10, 2014 at 17:23

1 Answer 1

12
7
  • 1
    Excellent answer that could not come from a better source. Thank you!
    – Paul
    Commented Jan 13, 2014 at 2:11
  • 1
    You're very welcome. It's a bit of a hard question to answer because the topic is so broad. If your review (I'm especially curious about Nexpose) does find anything then the last step is... drupal.org/security-team/report-issue :)
    – greggles
    Commented Jan 13, 2014 at 13:30
  • You're right, it was hard to ask as there are some many facets to security; however, the options given will be a great start. I will be sure to report anything Nexpose picks up, if it does at all.
    – Paul
    Commented Jan 13, 2014 at 17:14
  • 1
    I just wanted to follow up on this. Nexpose did not find anything related to Drupal, which is great news, although it should be noted that it is more of a network and server vulnerability scanner. I could add custom vulnerability checks, but Security Review is already doing that for Drupal, and it has been especially useful in the last few months. I also just purchased your book, which now I am getting more comfortable around Drupal, I am going to start reading and working through. Thanks for all you do!
    – Paul
    Commented Apr 21, 2014 at 18:20
  • 2
    By the way, I added 2 more modules that should also be run on production: tfa and password_strength.
    – greggles
    Commented Jul 11, 2016 at 13:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.