Drupal is the third most widely used CMS in the World and is considered the most secure among the top three open source CMSs (Drupal, WordPress and Joomla!). In today’s post our Drupal development experts are going to compile a list of eight solid reasons why you can trust Drupal with your business website.
Prior to that let’s find out what Drupal’s founder and project lead Dries Buytaert has to say on Drupal security. According to him there are many reasons that make Drupal secure including:
- Open source development model: Dries says that by the time he comes at a patch in Drupal Core, it’s usual that 20–30 more people would have seen it. This extreme pre-review is possible because of the open source development model of Drupal which is unusual to find in any proprietary software company.
- Dedicated security team: There are almost 30–40 people in the Drupal security team and it is much larger than any other proprietary software company’s security team.
- Drupal’s reach: Almost 2 percent of the websites of the world is powered by Drupal. Since many government agencies and entrepreneurs are using Drupal, they usually conduct a formal security audit on the source code. Therefore, it won’t be wrong to say, “Drupal is being audited more than anything else”.
Before we dive deep into the aspects that make Drupal secure and a platform that you can trust your site with, let’s take heed from the words of a world’s most famous hacker, Kevin Mitnick. When asked, “How easy is it to hack a system? He replied, “Any type of operating system that I wanted to be able to hack, I basically compromised the source code, copied it over to the university because I didn’t have enough space on my 200 megabyte hard drive.”
Since, Drupal’s source code undergoes extreme pre-review and is audited more than any other code in the world, this warrants the fact that it has the most concrete security.
Now let’s move on to the eight points that would validate the fact that Drupal has the most concrete security and why it is hailed as the most secure CMS:
#1 Large and engaging community
Drupal boasts of one of the largest and most engaging community in the world with more than 1 million developers, trainers, coordinators, strategists, designers, editors and sponsors on board. They work collectively, proactively and continuously to shape the platform and review the code and functionality.
With all these eyes constantly scrutinizing the code for errors ensures that any vulnerability found will be reported to the security team and dealt with promptly.
Thus, any serious vulnerability making its way into the official Drupal Core release is considered an extremely rare possibility.
#2 Drupal security team
As millions of websites breathe on Drupal, the security of this platform is the primary focus of the community. Hence, a Drupal security team was formed in 2005 comprising of 40 security experts from all over the world. They analyze and identify security vulnerabilities in the Drupal Core as well as the community-contributed modules.
The team then rectifies these issues by providing resources and assistance; also by releasing documentation on secure coding practices in order to help developers protect their sites by overcoming security related glitches in their code.
#3 Meets with OWASP standards
Drupal is secure by design, in other words, it is designed in such a manner that it effectively meets with all the security standards set by the Open Web Application Security Project (OWASP).
OWASP is a global not-for-profit charitable organization dedicated to improving the security of software. The organization has identified a list of top 10 security risks so that softwares are actively screened for them to avert future risks of security:
- Injection
- Broken Authentication and Session Management
- Cross Site Scripting – XSS
- Insecure Direct Object Reference
- Security Misconfiguration
- Sensitive Data Exposure
- Missing Function Level Access Control
- Cross Site Request Forgery – CSRF
- Using Components with Known Vulnerabilities
- Unvalidated Redirects and Forwards
Drupal is built upon a rich set of APIs and you can mitigate common security risks by their correct usage. Moreover, Drupal also addresses each of the aforementioned OWASP top 10 security risks effectively.
#4 Stable and secure codebase
Even though Drupal is an open source software, its core code base is highly stable and secure; thanks to the proficiency of Drupal security team in minimizing the chances of error. They thoroughly scrutinize each and every module contributed by a user and then approve it to make it available for the community.
Furthermore, if you belong to the Drupal community, you too have the authority to download a code and report any issue or bug that you identify.
No wonder that many enterprises bank on Drupal to build futuristic web apps!
#5 Password security
When you install Drupal, for the first time, the password is stored in the database in an encrypted form.Your password is salted and hashed many times in order to mitigate dictionary and brute force attacks.
Salting is a method of safeguarding passwords in storage by adding random data called salt to the password which is then processed with a cryptographic hash function. The purpose of salting is to make cracking of the password in storage near impossible and at the same time, safer and more complex than the hashed equivalent of the user entered password.
The password security is then further improved by adding many user contributed modules to support SSL certificates and 2-factor authentication.
You can also integrate single sign-on systems like Google sign-in or OpenID to provide another login option to your users.
#6 Authorized access controls
Drupal allows you to set up access controls that have full authority. In other words, it lets you create categorized accounts for various categories of websites.
For instance, if you create a blogging site then you can set different level of permissions and limit writers, editors or publishers to their defined roles. Thus, the user account can have separate access controls for users with different roles.
This feature improves the security of your application by restricting users from performing tasks that they are not supposed to execute and thus makes keeps the app glitch-free.
#7 Database encryption
Drupal allows you to configure it in order to encrypt the database on various levels. You can either encrypt the whole website database or specific parts of the database such as user accounts, content types, forms, etc.
These top-notch levels of encryptions allow you to configure Drupal such that it passeslaws of coding industry or various privacy standards like PCI, HIPPA.
#8 Drupal has built-in security reporting
Want to ensure top-level security for your CMS? Just make sure that your website is properly configured and the software as well as the add-ons or plugins, if any, are up to date.
The good thing about Drupal is that it comes with the feature of providing notifications regarding updating details and recommendations. This is to ensure that in case any vulnerability appears on your site, it is patched immediately.
Now you have the key to keep your website safe and prevent exploits by cyber criminals.
Summing up
Drupal is considered as the most secure CMS because of the aforementioned reasons – constant screening of source code, secure user access controls, top-notch security, engaging community and more. That is why Drupal is counted upon by many government and educational institutions as well as industry giants.
UNESCO, White House, Harvard University, Fox News, Tesla Motors, Lamborghini and Walt Disney are few eminent names to mention.
However, the naysayers highlight the complexity of Drupal as its con. You can easily overcome this only drawback; just collaborate with a Drupal development company like us and join the bandwagon of industry-leading brands that entrusted their business websites with Drupal.
Which feature of Drupal excites you the most? You can be the first to initiate a conversation by leaving your comments below.
Unfortunately, the White House decided recently to move to WP… However, Nasdaq is migrating all 4k business sites over to Drupal/Acquia: https://www.acquia.com/blog/dries/how-nasdaq-offers-drupal-distribution-service/13/02/2017/3301526
You might also mention IRS – they are pretty tight on security:
https://www.drupal.org/internal-revenue-service