Security Profile
This project provides a pre-configured setup for Drupal to enhance its security, covering authentication, brute force protection, data exposure prevention, cryptography, and logging. It aims to quickly secure a Drupal installation by implementing best practices based on the OWASP Top 10.
A quick setup has been implemented to enhance the security of a generic Drupal project, configurable with variables in a post-installation script. With the aim of streamlining the configuration, installation, and security times of each project.
The OWASP Top 10 was used as a reference framework to ensure it passes 90% of audits. Keep in mind that if any element is overly restrictive, you can relax it at your own risk.
Included Modules
- Authentication & Access Control: Enforces strong password policies, multi-factor authentication, and session timeouts.
- Password Policy (Length, character types, history)
- TFA (Two-Factor Authentication)
- Autologout
- Brute Force & Bot Protection: Mitigates automated attacks and unauthorized login attempts.
- Login Security
- Flood Control
- Advban (Advanced Ban)
- reCAPTCHA
- Data Exposure Prevention: Hardens HTTP headers and protects user data.
- Seckit (Security Kit)
- Username Enumeration Prevention
- Cryptography & Key Management: Infrastructure for encrypting sensitive data.
- Key
- Encrypt
- Real AES
- Audit & Logging: Comprehensive tracking for post-incident forensics.
- Event Log Track (Tracks auth, nodes, config, files, menus, users, etc.)
- Syslog (Core)
Site-Building Tools
While not strictly security-related, the profile includes essential administration tools to ease site management:
- Admin Toolbar (along with Tools and Search submodules)
- Token