By Kuldip Gohil on

Hi
Drupal Guys..

Is Our Drupal Is Secure???
I mean to say if we use all functionality of drupal then it is secure...

Waiting For Reply..
Thanks.
kuldip gohil

Comments

styro’s picture

styro commented

Drupals security (whatever you mean by that) depends mostly on the server you host it on, the extra code you add (either your own or contrib modules), what rights you give to untrusted users, and how well you keep it up to date.

But although no web software is absolutely secure, recent versions of Drupal have a very good track record.

--
Anton
New to Drupal? | Troubleshooting FAQ
Example knowledge base built with Drupal

Kuldip Gohil’s picture

Kuldip Gohil commented

if i want to use new fresh drupal downloaded from the drupal.org and then i host it on my server without any changes into the drupal configuration and no custom modules.. then it is secure??

styro’s picture

styro commented

Security is a process not a destination. What is "reasonably secure" today might not be "reasonably secure" tomorrow. You'll never be able to know what the bad guys know that the Drupal security team doesn't.

In your case, provided you secured your server properly, and kept up to date with Drupal patches, then yes I would regard that as secure you could hope for in a PHP web application.

--
Anton
New to Drupal? | Troubleshooting FAQ
Example knowledge base built with Drupal

Kuldip Gohil’s picture

Kuldip Gohil commented

i am agree with you, you are saying "Nothing is absolutely secure" is Right .. but in every system there should be secuirity up to some level

styro’s picture

styro commented

Drupal has a dedicated security team and takes security seriously:
http://drupal.org/node/32750

And between them those security team members are responsible for writing the bulk of the code that ends up in Drupal (as well as reviewing practically all it before it gets commited).

The Forms API introduced in 4.7 has been very useful in reducing the number of security problems in Drupal as it takes care of lower level input handling for the developer reducing the scope for mistakes. And further improvements in Drupal 5 have made it even better. No doubt Drupal 6 will improve it further.

eg the number of security update releases has been dropping for each new version despite Drupal getting more popular and being targetted more often by spammers and crackers etc. eg (from memory) 4.6 had about 11 security updates, 4.7 has had about 6, and so far 5 has had 2.

In my opinion Drupal is now one of the best PHP apps of its kind in terms of security (which admittedly isn't saying much by itself hehe). That isn't based on the wishful thinking some less mature/popular applications rely on though - which was the situation Drupal was in about 3 or 4 yrs ago.

--
Anton
New to Drupal? | Troubleshooting FAQ
Example knowledge base built with Drupal

rezamousoli’s picture

rezamousoli commented

I am writting an paper about Drupal, can you point me to the right direction?
Regards
rm