drupal

Recently our company worked with partners and sponsors to create a thoroughly researched, high quality document about the state of security in the open source Drupal project. You can download the report from DrupalSecurityReport.org, but right now I want to talk about the motivations, the audience, and the funding model behind the report because we feel that we've solved a tricky problem: funding expensive work in an easily copied medium (PDF downloads). We decided to try a variation on Techdirt's strategy to "Connect with Fans and give them a Reason to Buy".

This report was something that my colleague Ben Jeavons and I had wanted to do for a long time, but we couldn't fund it entirely from our own company resources. The target audience for the report is people who are considering Drupal and we didn't feel that they would be willing to spend money purchasing the report.

Connect with Fans

Fortunately, we have built up an audience among people interested in Drupal Security. Last fall I did a security webinar for a few hundred folks leveraging Acquia's webinars. Our blogs are directly read by a few thousand people interested in Drupal and are syndicated to over 20,000 readers readers interested in the topic. We've also done several presentations on Drupal security.

So, with a purpose and some fans in tow, we turned to business contacts we've made over the years to see if they could help with funding.

Reason to Sponsor

Based on discussions with them, our sponsors were motivated to sponsor the report based on three major ideas (and one sub-idea).

1. They sell Drupal in the enterprise space and are often confronted with questions about security and don't have a good answer. They wanted something they could point to.

Last week at DrupalCon SF we released the Drupal Security White Paper on drupalsecurityreport.org. The paper has been under development for the last several months and we worked hard to complete it in time for DrupalCon.

Addressing ongoing questions about Drupal security, the paper analyzes the Security Team's Security Advisories and discusses how Drupal 6 and 7 address common and critical security risks, including those of the OWASP Top Ten.

We couldn't have done it without the help of our sponsors, including Cydeck and Examiner.com among others, and without the help of our reviewers. Thank you!

If you're evaluating Drupal for use on your site, this report is for you. Or, if you're just curious to know more about Drupal and how it addresses security risks please give it a read.

Drupal core is very secure by default, but you can unknowingly open vulnerabilities with insecure configuration. An example of this is how allowing anonymous, untrusted users to use any HTML tag in comments opens a cross-site scripting attack vector on your site.

I'd like to introduce the Security Review module for automatically checking for the existence of insecure configuration and maintaining a secure Drupal site. With the first release come the following checks:

• Insecure file system permissions
• Insecure input formats
• Dangerous code in nodes and comments
• Printed errors
• Private files directory not set outside the web root
• Dangerous allowed upload extensions
• Permissions granted to untrusted roles

Security Review also looks for the common attacks of SQL injection/system probing and brute-force login attempts.

The module reports the result of its checks as pass or fail and provides details on an accompanying page. Checks may not be 100% accurate on every system so they can be skipped from being run. I often skip the error reporting check while on a development instance of my site. The checks are explained in detail and where applicable there are links to online documentation.

Future plans for the module include popular contrib module checks and notification support. I encourage you to give the module a run on your sites and let me know what you think in the comments!

Greg Knaddison

Growing Venture Solutions

July 2008

Greg Knaddison

greggles

2008/03/05 9:00

DrupalCamp Colorado

Best DrupalCamp Colorado Ever!

The bathrooms...

Big thanks to Denver Open Media.

Big thanks to Aten Design Group.

Do-ocracy
Drupal(Camp) is what you make of it.

tag it: drupalcampcolorado

drupalcamp

(on monitor upstairs)

Lightning!

S5 Presentation Layer.
Simple Standards-Based Slide Show System
(no, it's not SSBSSS nor S2BS3)
(because Eric Meyer said so)

<!--pagebreak--> + words = presentation!

Where are the slides?
Oh...they're already online in a shareable format.

Greg Knaddison

Growing Venture Solutions

July 2008

DrupalCamp Colorado

What is Views 1?
The views module provides a flexible method for Drupal site designers to control how lists of content (nodes) are presented.

What is views 2?
The views module provides a flexible method for Drupal site designers to control how lists of anything are presented with a kickass Ajax interface.

Questions?

Demo!

Raffle for Komodo
Advanced help
Non-node tables

Session list (and block)
Basic node list
Overrides

Comments + moderation

Image + ajax + minipager = carousel...?

Stump the Chump!

Greg Knaddison

Growing Venture Solutions

July 2008