The Content Management System (CMS) market is a very competitive sector. There are many key players involved that are vying for user attention. Each CMS provider offers unique features and performance that cater to various audiences. For instance, WordPress, one of the largest CMS players in the world, powers a disproportionate amount of websites on the web due to its fast learning curve and relative ease of use. Although WordPress is one of the more dominant CMS providers, it is also one of the most heavily targeted in terms of web attacks. For users that want to explore more robust control of their websites while also receiving formidable website security, then Drupal is the clear choice.
WordPress vulnerabilities can be directly attributed to its sheer size, volume of users, and the actual type of users who utilize its services. More specifically, WordPress attracts a large audience of casual website owners who enjoy a more user friendly interface and the option to install automated plugins to help increase user experience. However, hackers tend to gravitate towards those that are most vulnerable and ill-equipped to counteract their malicious web attempts to steal personally identifiable information (PII) or financial data. Drupal allows users to enjoy a more complete web experience by giving its customers freedom to customize and go in depth with the actual development of their websites. This naturally leads to a different type of user base—those with knowledge of web development and initial web security. In addition, Drupal goes above and beyond to ensure a more secure web environment for their users. This is evident in the last 3 fiscal years of reported website security announcements and active mitigation.
Cloudbric, an award winning Web Application Firewall (WAF) vendor, reviewed CMS vulnerabilities and security risks in relation to information provided by the non-profit group Exploit Database. Research was conducted from January 2013 to October 2015. During this specified time period, the EDB reported only 1 critical security vulnerability to the Drupal Core System, which was the lowest among all CMS platforms during the test period. Drupal differentiates itself from other CMS providers due to their internal dedication to security. For starters, Drupal deploys various subject matter experts to review and analyze HTML coding to mitigate the first hand risk of security vulnerabilities that could be overlooked throughout the development phase. The extra layers of review and oversight is a testament to Drupal’s commitment to user security, especially in a space where smaller website developers and owners are susceptible to attack. Additionally, Drupal also ensures active security by having an in-house team of specialists who constantly monitor and address potential vulnerabilities and attacks.
Drupal’s security history is rather impressive. The only major security flaw reported from 2013-2015 occurred on October 15, 2014. At the time, Drupal support staff officially announced a highly critical security issue (SA-CORE-2014-005) stemming from a major vulnerability in its Drupal 7 database abstraction API. This left users exposed to malicious SQL Injection attempts by hackers. SQL Injections are some of the most prevalent and dangerous web attacks that can destroy any data present in a website. This form of web attack can override a web application’s authentication and access methods, which can ultimately lead to unauthorized sensitive data exposure for both the website owner and potential customers. Drupal was able to quickly remediate their highly critical SQL vulnerability with a security patch announcement on October 29, 2014. This is a very quick turnaround time to help not only mitigate the primary issue, but to also provide detailed instructions for users to ensure full security on their Drupal powered websites.
As a complementary security feature, Cloudbric highly recommends Drupal users to also integrate an effective Web Application Firewall (WAF) to their cybersecurity profile to work in conjunction with Drupal’s already secure CMS environment. Although Drupal’s turnaround time to issue a security patch was extremely fast, users can also take advantage of a secondary layer of website security with Cloudbric’s intuitive and interactive dashboard. Furthermore, Cloudbric also seamlessly integrates into the Drupal CMS and will act as a proxy between prospective web visitors and the primary web server to filter out all malicious incoming and outgoing web traffic.
There are three primary benefits for utilizing a WAF to support Drupal web security.
1. Protection Against Known and Unknown Web Attacks
Cloudbric’s patented Logic Analysis Engine utilizes a revolutionary self-learning detection engine that recognizes both known and unknown web vulnerabilities. For instance, for all known web security issues, such as SQL Injections, Cloudbric will automatic block all web visitors that attempt to infect a website by “injecting” malicious HTML code into the targeted website. This will act as an insurance policy or added protection during any down time where Drupal security specialists are working hard to provide an updated security patch.
2. Enterprise Grade Detection Technology
Second, Cloudbric’s enterprise level WAF will also self-learn and effectively “predict” new and unknown web attacks that may occur. Cloudbric developed an industry leading detection engine that utilizes 26 preset rules to filter all suspicious inbound and outbound web traffic. Furthermore, Cloudbric’s WAF uses a non-signature based engine to detect web attacks, whereas most security vendors use a signature based pattern matching system, which is an outdated detection methodology that can lead to lower accuracy and higher false positive (inaccurate blocking of innocent traffic) rate.
3. Seamless CMS Integration and Customized Protection
Lastly, Cloudbric’s innovative dashboard works perfectly with Drupal CMS to give users the ability to independently review and analyze all potential web attacks and traffic that is directed to their respective websites. Cloudbric will automatically block all known web attacks for users as a default; however, for all detected unknown cyber attacks, Cloudbric users are able to permanently block the web attack instead of waiting to manually download a security patch. This can prove to be the difference between being exposed to any zero-day exploits, which is the time between the first official announcement of a web vulnerability to the day that a security patch is released.
Cloudbric is an elite full service website security solution that you can depend on. Powered by Penta Security Systems’s WAPPLES detection technology, Cloudbric aims to serve small and medium business owners by providing enterprise level website security that they truly deserve. Cloudbric is the no. 1 Web Application Firewall vendor in the APAC region and currently protects more than 117,000 websites and blocks 108,000,000 web attacks per month. Get started with free Cloudbric protection today! To learn more, please visit www.cloudbric.com or contact us at global@cloudbric.com.