Named Drupal security controls and processes: advisory response, security headers, login and password protection, spam defense, secrets handling and security testing scope.
Responding to Drupal core and contributed advisories: the Wednesday security window, risk levels, public service announcements for critical releases and an update process that meets internal patch deadlines.
What the paid Drupal Steward service protects against, how its virtual patching buys time for highly critical core vulnerabilities, and why it does not replace updates.
Using Security Kit for clickjacking, cross-site scripting and CSRF mitigations and HTTP security headers, and checking headers set at the web server or CDN.
Rolling out a Content-Security-Policy header with the CSP module: report-only mode first, allowances for embeds, analytics and admin tools, and keeping it maintainable.
Enforcing password rules, limiting failed logins with flood control settings, blocking username enumeration and logging out idle sessions for editor and admin accounts.
Protecting registration, comment and webform submissions from bots: Honeypot and Antibot for low friction, CAPTCHA where needed, and accessibility trade-offs.
Keeping API keys and encryption keys out of configuration exports with the Key module, environment or external storage, and field encryption with Encrypt.
Using the Security Review module to catch common misconfigurations such as unsafe file permissions, text formats and error reporting, and adding it to release checks.
Judging contributed modules before adoption: security advisory coverage, maintenance status and usage, unsupported projects, and the review a regulated site needs before installing new code.
What a security test of a Drupal site should cover: exposed admin and user paths, custom modules, file upload handling, access bypass in views and APIs, and outdated contributed code.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.