Actions

Difference between revisions of "Security Checklist/Site Administration"

From Joomla! Documentation

< Security Checklist
(Go To Site Recovery)
(added 2 factor auth)
(16 intermediate revisions by 6 users not shown)
Line 1: Line 1:
{{RightTOC}}
+
{{:Security Checklist/TOC}}
 
+
 
== Site Administration ==
 
== Site Administration ==
  
 
===Use well-formed passwords===
 
===Use well-formed passwords===
: Change passwords regularly and keep them unique. Use a random combination of letters, numbers, or symbols and avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites.
+
: Change passwords regularly and keep them unique. A strong  password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].
  
===Follow a password leveling scheme===
+
===Consider using 2 factor authentication===
: Most users may not need more than three levels of passwords and webmasters no more than five. Each level must be completely unrelated to the others in terms of which usernames and passwords are used.
+
: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi|3.2}}
  
 
===Maintain a strong site backup process===
 
===Maintain a strong site backup process===
: Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you can not rely solely on their backups.
+
: Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you cannot rely solely on their backups.
  
 
===Monitor crack attempts===
 
===Monitor crack attempts===
: VPS and dedicated server users can run TripWire or SAMHAIN. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers can not use this technique.)</li>
+
: VPS and dedicated server users can run [http://www.tripwire.com/ TripWire] or [http://la-samhna.de/samhain/ SAMHAIN]. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers cannot use this technique.)</li>
  
 
===Perform automated intrusion detection===
 
===Perform automated intrusion detection===
Line 24: Line 23:
 
===Stay current with security patches and upgrades===
 
===Stay current with security patches and upgrades===
 
: Apply vendor-released security patches ASAP.
 
: Apply vendor-released security patches ASAP.
 +
* Review the [http://docs.joomla.org/Vulnerable_Extensions_List vulnerable extensions]
  
 
===Proactively seek site vulnerabilities===
 
===Proactively seek site vulnerabilities===
Line 31: Line 31:
  
 
===Proactively seek SQL injections vulnerabilities===
 
===Proactively seek SQL injections vulnerabilities===
: Use tools such as Paros Proxy for conducting automated SQL Injection tests against your PHP applications.
+
: Use tools such as [http://www.parosproxy.org/ Paros Proxy] for conducting automated SQL Injection tests against your PHP applications.
 
       <ul>
 
       <ul>
 
         <li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>
 
         <li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>
Line 49: Line 49:
  
 
===Don't reinvent every wheel===
 
===Don't reinvent every wheel===
: Every now and then hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, ''"Anyone who acts as their own lawyer has a fool for a client."'' The same goes for Web development. Don't expect to catch all of your own security mistakes.
+
: Every now and then, hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, ''"Anyone who acts as their own lawyer has a fool for a client."?'' The same goes for Web development. Don't expect to catch all of your own security mistakes.
 
+
== Go To Site Recovery ==
+
: When you're ready, continue on to [[Security Checklist 6 - Site Recovery]].
+
 
+
  
 
<!-- KEEP THIS AT THE END OF THE PAGE -->
 
<!-- KEEP THIS AT THE END OF THE PAGE -->
 
[[Category:Security Checklist]]
 
[[Category:Security Checklist]]

Revision as of 04:16, 17 March 2014

Site Administration

Use well-formed passwords

Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have strong password generators.

Consider using 2 factor authentication

For superusers (and perhaps other powerful users) consider using 2 factor authentication.  Joomla 3.2

Maintain a strong site backup process

Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you cannot rely solely on their backups.

Monitor crack attempts

VPS and dedicated server users can run TripWire or SAMHAIN. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers cannot use this technique.)

Perform automated intrusion detection

Use an Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests.

Perform manual intrusion detection

Regularly check raw logs for suspicious activity. Don't rely on summaries and graphs.

Stay current with security patches and upgrades

Apply vendor-released security patches ASAP.

Proactively seek site vulnerabilities

Perform frequent web scanning.

Proactively seek SQL injections vulnerabilities

Use tools such as Paros Proxy for conducting automated SQL Injection tests against your PHP applications.

Use shell scripts to automate security tasks

Search the forums for these popular scripts:
  • Joomla! Version Checking
  • Joomla! Component/Module Version Checking
  • Exploit Checking

Learn about security software

There is not a single tool that can protect your site. If there were, it would be so heavily targeted that it would probably become a liability.

Don't reinvent every wheel

Every now and then, hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, "Anyone who acts as their own lawyer has a fool for a client."? The same goes for Web development. Don't expect to catch all of your own security mistakes.