I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal site, I want to be certain that it is as secure as possible. I have completed as many proactive security measures as possible, including following the secure configuration and the best security practices guides on drupal.org, I've subscribed to the security newsgroup, and hardened the LAMP server using industry best practices.

Now that I have completed due diligence with regards to proactive security, I want to run a security audit before we go live to be able to generate a report stating we are "as secure as possible" for management. I usually do all of the testing by hand, page-by-page, using the OWASP Web App testing cheatsheet; however, I'm new to Drupal, this site is hundreds of pages, and I have limited time.

What are your recommendations for security testing a Drupal site of this size? I have access to Rapid7's Nexpose Enterprise, so I will be using that for some automated testing. I do not want to use hosted scanning tools, but will consider security-audited tools that I can install myself to use. Do you have security checklists you go by, similar to OWASP, but specific to Drupal 7? Any other advice for things I might have missed are also appreciated!

  • 2
    You'll always need to define specific tests to comply with your internal security standards, of course, but for general things there's the Security Review module. The specific tests will obviously vary wildly depending on what modules and configurations you're using. Apart from the obvious xss/injection attacks what you're testing for will depend on what a module is supposed to do, and how it interacts with core and other modules in the system
    – Clive
    Jan 10 '14 at 17:23
  • 1
    Excellent answer that could not come from a better source. Thank you!
    – Paul
    Jan 13 '14 at 2:11
  • 1
    You're very welcome. It's a bit of a hard question to answer because the topic is so broad. If your review (I'm especially curious about Nexpose) does find anything then the last step is... drupal.org/security-team/report-issue :)
    – greggles
    Jan 13 '14 at 13:30
  • 1
    I just wanted to follow up on this. Nexpose did not find anything related to Drupal, which is great news, although it should be noted that it is more of a network and server vulnerability scanner. I could add custom vulnerability checks, but Security Review is already doing that for Drupal, and it has been especially useful in the last few months. I also just purchased your book, which now I am getting more comfortable around Drupal, I am going to start reading and working through. Thanks for all you do!
    – Paul
    Apr 21 '14 at 18:20
  • 1
    Couple dead links. Tried to search docs.acquia.com but wasn't sure what you were referring to - do you by chance know where that content is now? Jul 24 '15 at 23:46
  • 1
    @digitgopher I migrated the content and fixed the links. Thanks for noticing.
    – greggles
    Jul 30 '15 at 14:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.