It's Friday - what a day to visit jfoobar!

Joomla! Security and unsafe Sex

Written by Wilco Jansen Sunday, 16 November 2008 13:41

I probably disappoint you when I say that this post is not about sex and certainly not about unsafe sex. At my presentation at the Swiss Joomla!day about Joomla! Security I made the comparison between unsafe sex and Joomla! Security.

I started my presentation with the question if Joomla! is safe followed by the question if the web in general can be seen as a safe place. Regarding the web it's pretty clear, companies make big money by providing all kinds of protections like virus scanners, firewalls and anti-spam tools. Often we see reports of sites being hacked or compromised, credit cards stolen or sites that have been used for denial of service attacks. So in general I think everyone will agree the web is not a safe place by default. The same is true for unsafe sex...if you don't take precautions, you can get a disease of which some can be pretty serious.

When we look at Joomla! the question if it's safe by default can be answered in several ways, but as with the Internet the default answer of course is no. As with every web solution this answer will be the same, but let's look at possible answers that can be given on the following question: “Is Joomla! Safe?”

Answer 1: By default the Joomla! code base is considered to be very safe. If there is a high-level security threat it will be fixed very fast. We don't pretend that it's safe tomorrow simply because the hackers also will try to do their dirty job.

Answer 2: By default the Joomla! code base is considered to be safe, but without a safe hosting environment even the most secure release of Joomla! will be compromised.

Answer 3: By default the Joomla! Code base is considered to be safe, but without a proper scan on the extensions you install your site can be compromised by the first unsafe extension you ever install on your site.

Get the picture? I probably can come up with even more answers and combinations, but that's not what this is all about. Web security fist of all is about awareness. Do you understand the possible risks your site is exposed to? Do you have an idea what precautions you can take to make your site as safe as possible? Do you have a (preferable simple) strategy to maintain the level of desired safety?

The debate around Joomla! Security is intensifying in our forums and blogs. In a lot of the situations we see that people who get compromised simply have not taken a basic set of precautions, or even worse simply don't care about setting up a basic line of defense.

In these situations we of course could counter their complains about Joomla! being insecure by asking if they also have unsafe sex, or maybe a bit less direct if they also run a virus scanner on their system. I assume that in most cases the people will answer “of course I protect my personal computer, that's logical, everyone knows that you should do that” or coming back to the sex example: “Of course we don't have unsafe sex”.

Why do we see so many examples of people that have not taken the proper precautions to protect their site? I did not do in depth research, but have some ideas:

• You can install Joomla! In basically any environment that has a web server and MySQL running. The ease of use gives people the impression that all complexity of the web site protection is being taken care of automatically. Joomla! is a very popular content management system. Millions of people use it, but the turn side of this success is that the platform is also attractive to the army of hackers.
• Joomla! Has several thousand extensions available and even more templates. Not every extension developer is a web professional, and is not familiar with best practices of building safe extensions. Sometimes the extensions are not being maintained anymore, and when a vulnerability is found it is not being fixed. End users or site administrator don't have the knowledge to set up a safe environment.
• There are for sure more reasons that I can come up with, but the most important thing I got to realize is that in general people tend to not read the available information and just assume that certain topics are being covered for them. Maybe we should make Joomla! Less easy to use...

What I try to do at security presentation I give is explain to people why it's important, and what people can to to make their site more secure. I also hammer out what people can do if they get compromised and how the Joomla! Working groups operate. This all to give people a better understanding how they can protect their sexy Joomla! site from having unsafe sex.

In the upcoming weeks Jfoobar team will try to cover some of the topics that are important for better securing your Joomla! Site. Stay tuned!

Like it? Share it!

• bookmark.it
• del.icio.us
• digg
• furl
• blinkllist
• reddit
• feedmelinks
• technorati
• yahoo
• rawsugar
• netvouz
• rojo
• shadows
• gabbr
• dzone
• newsvine
• ma.gnolia
• stumbleupon
• google
• squidoo
• spurl
• blinkbits
• blogmarks
• bloglines
• co.mments
• scuttle
• ask
• slashdot