Cyber security is like putting a sturdy lock on the door of your digital house.
Just as a strong lock secures your home against intruders, robust cyber security keeps malicious hackers at bay, protecting your valuable data.
LocalGov Drupal security overview
The LocalGov Drupal platform is a specialised distribution of the leading open-source content management system (CMS) Drupal.
As an open-source platform, Drupal has the advantage of ongoing security scrutiny and input from developers worldwide and a dedicated staff team of security experts collaborating consistently to address and release security features.
The Drupal community, consisting of over 1 million members, actively works to keep the software secure. Supported by a diverse security team from various sectors and nine countries, Drupal ensures a broad range of perspectives in maintaining platform security. Drupal Steward, a user-friendly web application firewall (WAF), helps to minimise vulnerabilities between security updates and site patches.
The platform's secure nature means it's trusted by some of the most well-known corporations in the world:
However, like any CMS, Drupal presents a target to potential hackers looking to cause chaos. Read on for the best practices Drupal users can implement to thwart cyberattacks when installing their site.
LocalGov Drupal best practice security guidelines
The LocalGov Drupal best practice security guidelines cover the following areas:
- Malicious File Uploads: Be wary of unauthorised file uploads
- Missing Anti-Scripting Controls: Ensure proper measures are in place to prevent malicious scripts.
- Weak Password Policy: Enforce strong, unique passwords for all users.
- Username Enumeration: Block attempts to guess usernames through trial and error.
- Missing Security-Related Headers: Configure essential security headers to protect your site from common attacks.
- Verbose Error Messages: Avoid revealing sensitive information in error messages.
- Insufficient Session Timeout: Set appropriate session timeouts to prevent unauthorised access.
- Weak Account Lockout Mechanism: Implement a robust account lockout system to deter cyber criminals.
- Verbose HTTP Response Headers: Minimise unnecessary information in HTTP response headers.
For a detailed explanation of the above areas, head to the LocalGov Drupal documentation.
Cyber security: a public sector priority
Public sector organisations are prime targets for cybercrime. With citizen data and critical services at stake, cybersecurity is non-negotiable. The Government Cyber Security Strategy aims to bolster resilience by 2030, but the threat is real – according to the Cabinet Office, over 40% of cybercrime in 2021-22 targeted the public sector.
With this in mind, let's explore some important steps that can help keep Drupal sites locked down.
Stay sharp by keeping your Drupal version up-to-date
Stay ahead in the ever-evolving battle of cybersecurity by ensuring your Drupal version remains up-to-date. The latest Drupal versions seamlessly integrate security updates, shielding you from vulnerabilities. However, it's crucial to note that using unsupported versions could expose you to risks.
Reminder: Drupal 7 websites have been granted an extended End of Life until 05/01/2025, but it's advisable to start planning your upgrade as soon as possible. Find out more in our Drupal 7 extended lifeline blog.
Stay informed by subscribing to Drupal security alerts
Drupal makes it easy to stay informed with the latest security advisories. Check out the official Drupal security page for the latest advisories and updates. Additionally, subscribing to Drupal security emails can provide timely notifications directly to your inbox.
Here's how to subscribe:
Log in to Drupal.org, navigate to your user profile page, and subscribe to the security newsletter on the Edit » My newsletters tab.
Staying proactive about security is key to safeguarding your website and data against emerging threats.
Part of the LocalGov Drupal family? Claim your free site audit with Webcurl!
At Webcurl, we have extensive experience assisting councils with upgrading to the latest versions of LocalGov Drupal. As a valued member of the LocalGov Drupal community, we invite you to take advantage of our free site audit. Our experienced team will identify the optimal approach to upgrading your website. Additionally, we offer tailored development, hosting, and support services to ensure your website remains current and operates seamlessly.
Thinking about migrating to LocalGov Drupal?
Webcurl is proud to be an official supplier of the LocalGov Drupal platform, currently supporting the following councils.
Ready to elevate your council's online presence? Reach out to Webcurl today. We're committed to helping you achieve your digital goals every step of the way.