The company I work for has some pretty heft security requirements, so I'd like to do some research before I propose Drupal as an option for one of our sites.
Site Info: Basically, it would be an informational website where we would edit/add/remove content from time to time. From a user prospective, we just want folks to be able to peruse and view the info, we do not want them to be able to log in or anything.
Setup: I have an existing webserver (Linux) and DB (MySQL) already hosting two other sites. This new one would go on the same server and use the same MySQL.
Here's where it gets tough...
Install: I have to have the CMS installed in two locations (pointing to the same DB). One location will be internal and the other would be the location that has external access. Any changes to content, etc have to be made from the internal location with the external location picking up the updates from the DB. Since the external talks to an internal DB, they've given me a very strict requirement: no admin access for external.
Basically, for external users, they don't want the admin aspect to even exist or be available. Blocking access (i.e. strong passwords, .htaccess have been proposed and nixed).