In today’s network-centric world of technology, Open Source Software (OSS) like Drupal has been one of the leading software solutions for government agencies and organizations ranging from mom-and-pop shops to large enterprise corporations. Drupal allows application developers to freely analyze, modify, and redistribute its source code with no cost. Since the majority of OSS source code is reviewed and modified by the general public, many security concerns have arisen for organizations planning to implement Drupal.
Drupal Concerns
Open source software code is publicly accessible to developer communities. The thought is that Drupal is vulnerable to hackers and malicious users, making it less secure and unstable compared to commercial, off-the-shelf software. On the contrary, Drupal is not any less secure then this software. In fact, with community-based support, Drupal is more secure and responsive to vulnerabilities. It provides a community in which developers can find, fix, and distribute patches for source code faster than proprietary programs.
Composed of a community of volunteers, the Drupal security team is actively involved with the open source community. They use an organized process to address security vulnerabilities and are very reliable when it comes to fixing security issues, analyzing vulnerabilities in code, and giving expert advice and assistance to contributors.
To protect against common everyday security threats such as cross site scripting, injection, session management, and cross site request forgeries, Drupal developed custom APIs. The Drupal APIs are packaged with standard solutions that are capable of handling each security threat. Keep in mind: it is often human error, not the software that causes an application to be vulnerable to security threats.
Drupal Vulnerabilites
There are two areas of vulnerability when implementing Drupal as a solution: custom code that is not shared with the community for scrutiny, and insecure protocols at the server level. Once Drupal is implemented into an organization, code generated for the specific purposes of the organization may not be authorized for sharing with the Drupal community. Application developers must have a fully functional understanding of Drupal, and the working knowledge of their organizations systems, to minimize threats when custom code is developed and implemented into an application.
As an experienced website and web application developer, I would 100% recommend Drupal as a secure solution across both large organizations and small businesses. Drupal has been used to create websites for college academic departments, news and entertainment venues, E-Commerce, blogs, and government organizations, including the White House. Here at Segue, we have personally used Drupal with success on multiple customer projects to realize secure sites with account driven menus and data restrictions. Just keep in mind: the software you implement is as secure as your knowledge of the system. All types of software are vulnerable to bugs, but with an active community of developers, and an organized process to resolve and release patches, system administrators can be at ease knowing that Drupal is a secure type of open source software.
For more information on Drupal, make sure to read How Much Does a New Drupal Website Cost to Develop?