Ainsofs Blog: Technology insights from the Pacific Islands

  I had a chance to check out the Talking Drupal: Drupal security podcast. These were my key takeaways. Top 3 tips Its stuff we already know about but don't do. Lets educate and remind ourselves and others. Do not write down passwords (especially on sticky notes). Use a Password Manager e.g. LastPass , Bitwarden , Passbolt Patch your modules. Security patches are released every 3rd Tuesday of the month by the Drupal Security team . Sign up to security announcements. You can use RSS feeds to bring updates to your slack, teams, etc. There is also a Discord site . Use tools that make your code better. e.g. CI to make it more readable (coding styles, comments). Code reviews. Write the least amount of code as possible. No code is best ie only using Core and Contrib modules. (IMO, as a developer this is impossible 😂)    Contrib modules to help improve Drupal security Cloudsec - Uses the Crowdsec service to block malicious traffic Username enumeration prevention - ...

These are my key takeaways from the DrupalSouth '22 talk - "The Pragmatic Guide to Defending Drupal". It covered ways to defend Drupal from cyber attacks but can also be used in other stacks. They are categorised into the following environments:  local dev - your day to day development environment pull request/ deployment - the process of pushing your code to your repo hosting/prod environment - your production environment Key takeaways Have an incident response plan (local dev environment) Can be as simple as using your README.md file with the following headings If you look after multiple sites, use a central document or handbook for the organisation to refer to It tells owners what to do in case of an incident Use a CDN (hosting/prod environment) Cloudflare, Fastly and Akamai were mentioned (I work with Cloudflare, it has many defense mechanisms) Amazon Cloudfront - recommended if you are already hosting with AWS CDNs provide a way to mitigate the attack at the proxy...