Drupal Security: What You Need to Know
Download as PPTX, PDF0 likes666 views
This document discusses Drupal security best practices. It begins with introducing Mediacurrent and its vision to empower people with open source technology. It then provides an agenda on Drupal security covering Security-First planning, the Drupal security team and resources, common vulnerabilities, and Drupal best practices such as module selection, patching, and API usage. The document emphasizes automating security processes, monitoring advisories, and cultivating a security-focused culture.
![| 20
// Uh, oh: $my_var = "<script>alert('Attack!')</script>";
Not This:
$variables['title'] = "Here's a title: " . $my_var;
Instead, this:
$variables['title'] = t("Here's a title: @title", ['@title' => $my_var]);
Also see
Drupal::translation()->formatPlural()
t()](https://image.slidesharecdn.com/mediacurrentdrupalsecuritywebinar-slideshare1-210328231227/85/Drupal-Security-What-You-Need-to-Know-20-320.jpg)
![| 21
// Uh, oh: $my_var = "<script>alert('Attack!')</script>";
// Oh, no: $my_other_var = "<div>some unexpected HTML</div>";
Not This:
$variables['title'] = '<p>' . $my_var . '</p>';
$variables['body'] = $node->get('body')->value . $my_other_var;
Instead, this:
$variables['title'] = Xss::filter($my_var);
$variables['body'] = $node->get('body')->value . Html::escape($my_other_var);
Xss::filter() and Html::escape()](https://image.slidesharecdn.com/mediacurrentdrupalsecuritywebinar-slideshare1-210328231227/85/Drupal-Security-What-You-Need-to-Know-21-320.jpg)
![| 23
// Uh, oh: $my_var = ", (SELECT * FROM private_data) as attack";
Not this:
Drupal::database()->query('SELECT * FROM node_field_data ' . $my_var);
Instead, this:
// Better.
Drupal::database()
->select('node_field_data', 'd')
->fields('d', [])
->condition('d.nid', $my_var);
Drupal:database()
// Better yet.
Drupal::entityTypeManager()-getStorage('node')
->getQuery()
->condition('nid', $my_var);](https://image.slidesharecdn.com/mediacurrentdrupalsecuritywebinar-slideshare1-210328231227/85/Drupal-Security-What-You-Need-to-Know-23-320.jpg)
![| 24
Not this:
public function myControllerBuild($nid) {
// ...
$node = $this->entityTypeManager()
->getStorage('node')->load($nid);
// ...
$build['node'] = $node->view();
return $build;
}
Controllers
Instead, this:
public function myControllerBuild($nid) {
// ...
$node = $this->entityTypeManager()
->getStorage('node')->load($nid);
// ...
if($node->access('view', $this->currentUser)) {
$build['node'] = $node->view();
}
return $build;
}](https://image.slidesharecdn.com/mediacurrentdrupalsecuritywebinar-slideshare1-210328231227/85/Drupal-Security-What-You-Need-to-Know-24-320.jpg)
Drupal Security: What You Need to Know
- 1. Drupal Security: What You Need to Know March 25, 2021
- 3. Our vision is to empower every person on the planet with the innovative freedom and community impact that open-source technology offers. Our Vision
- 4. Today’s Team Mark Shropshire Senior Director of Development Bobby Gryzynger Senior Developer
- 5. Bobby Gryzynger Senior Developer /in/bobby-gryzynger ● From Madison, Wisconsin. Currently in northern NJ ● 5+ years of experience as a Drupal developer ● Enjoys contributing to Drupal development. Has committed work in several contributed modules as well as Drupal core ● Breakfast chef. French toast? Pancakes? I’m your man Skills ● Drupal ● Security ● DevOps ● Project Leadership ● Drupal best- practices
- 6. Mark Shropshire Senior Director of Development /in/markshropshire @shrop ● From Concord, North Carolina ● 20+ years of experience as a technical team leader ● Loves empowering teams to excel while using best of class open source technology solutions. ● Passionate about personal and team growth through mentorship, aligning individual purpose with Mediacurrent’s vision ● Plays sax, drums, keys, and bass and has a list of other instruments that he would love to learn! Skills ● Drupal ● Security ● DevOps ● Flutter ● Acquia Site Factory ● Leadership
- 7. 1. What’s Security-First? 2. Security and The Drupal Community 3. OWASP Top 10 Web Vulnerabilities 4. Drupal Best Practices 5. Q&A Today’s Agenda
- 9. Security-First means going beyond compliance to assess risk. It’s both a cultural mindset and a continuous development approach that’s rooted in process automation.
- 10. Security-First Planning ● Proactive and collaborative approach with stakeholders ● Layered defense ● Architecture reviews ● Code reviews ● Automated testing ● Continuous improvements ● Security audits (one-offs and ongoing) ● Documentation
- 11. Security and The Drupal Community
- 12. Drupal Security Team ● Resolves reported security issues in Security Advisories ● Provides assistance for contributed module maintainers in resolving security issues ● Provides documentation on how to write secure code ● Provides documentation on securing your site ● Help the infrastructure team to keep the drupal.org secure ● https://www.drupal.org/security-team
- 13. Guardr is a Drupal distribution with a combination of modules and settings to enhance a Drupal application's security and availability to meet enterprise security requirements. Guardr incorporates industry best practices from security standards, regulatory controls, and security certifications. https://drupal.org/project/guardr Drupal Slack: #contrib-guardr
- 14. OWASP Top 10 Web Vulnerabilities
- 15. | 15 Top 10 Web Application Security Risks Injection Broken Authentication Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Cross-Site Scripting XSS Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring https://owasp.org/www-project-top-ten
- 17. Module Selection ● Module Usage ● Issue Queue Activity ● Security ● Manual Review and Testing ● Release Status ● Commit Activity ● Project information ● Risk Assessment ● Benefit A Guide to Drupal Module Evaluation
- 18. Module patches ● Sometimes, patches are necessary ● Always submit patches to Drupal.org ● Submitting patches allows: ○ Automated testing ○ Maintainer review ● Patches create: ○ Revision history ○ An opportunity for community input
- 19. Use Drupal APIs Use Drupal APIs to secure your contrib and custom code. https://api.drupal.org/api/drupal Writing secure code for Drupal
- 20. | 20 // Uh, oh: $my_var = "<script>alert('Attack!')</script>"; Not This: $variables['title'] = "Here's a title: " . $my_var; Instead, this: $variables['title'] = t("Here's a title: @title", ['@title' => $my_var]); Also see Drupal::translation()->formatPlural() t()
- 21. | 21 // Uh, oh: $my_var = "<script>alert('Attack!')</script>"; // Oh, no: $my_other_var = "<div>some unexpected HTML</div>"; Not This: $variables['title'] = '<p>' . $my_var . '</p>'; $variables['body'] = $node->get('body')->value . $my_other_var; Instead, this: $variables['title'] = Xss::filter($my_var); $variables['body'] = $node->get('body')->value . Html::escape($my_other_var); Xss::filter() and Html::escape()
- 22. | 22 Monitor Drupal Security Advisories ● Drupal core ● Drupal contrib projects ● Public service announcements ● Notifications via email and RSS ● Follow @drupalsecurity on Twitter ● Drupal Slack #security-questions ● Read SA documentation https://www.drupal.org/security
- 23. | 23 // Uh, oh: $my_var = ", (SELECT * FROM private_data) as attack"; Not this: Drupal::database()->query('SELECT * FROM node_field_data ' . $my_var); Instead, this: // Better. Drupal::database() ->select('node_field_data', 'd') ->fields('d', []) ->condition('d.nid', $my_var); Drupal:database() // Better yet. Drupal::entityTypeManager()-getStorage('node') ->getQuery() ->condition('nid', $my_var);
- 24. | 24 Not this: public function myControllerBuild($nid) { // ... $node = $this->entityTypeManager() ->getStorage('node')->load($nid); // ... $build['node'] = $node->view(); return $build; } Controllers Instead, this: public function myControllerBuild($nid) { // ... $node = $this->entityTypeManager() ->getStorage('node')->load($nid); // ... if($node->access('view', $this->currentUser)) { $build['node'] = $node->view(); } return $build; }
- 25. | 25 Secure your open source-based martech stack with this resource for best practices. http://bit.ly/open-source-security Download Now CMO’s Guide to Open Source Security
- 26. | 26 Key Takeaways Cultivate a security-first culture. Educate yourself on security risks that can impact your organization. Review and monitor Drupal security advisories. Follow Drupal best practices. Automate security processes. Promptly update security releases.