Answers.Body: <p>Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance.  There are a couple of questions here about that topic:</p>
  
  <ul>
  <li><a href="https://civicrm.stackexchange.com/q/10390/105">CiviCRM &amp; PCI Compliance</a></li>
  <li><a href="https://civicrm.stackexchange.com/q/15857/105">How hard is it to obtain PCI compliance?</a></li>
  </ul>
  
  <p>Here is another helpful question/answer about security and Civi, but with reference to Joomla (same principles apply really): <a href="https://civicrm.stackexchange.com/q/8931/105">Installing CiviCRM - best security practices</a></p>
  
  <p>Agreeing with Erik, using SSL is at the top of the best practices list (you can check your site's security for free with <a href="https://www.ssllabs.com/ssltest/" rel="nofollow noreferrer">https://www.ssllabs.com/ssltest/</a>).  With "SSL" as a practice though, you will want to adjust your ciphers to disallow known vulnerabilities. Limiting your server to just TLSv1.1 and TLSv1.2 is becoming the standard (and just TLSv1.2 is preferred if you don't need to support older browsers).  Our payment vendor (iATS) requires the use of a service like TrustWave that scans our setup once per month (and ad hoc as needed) and lets us know of any vulnerabilities and updates needed to maintain PCI Compliance.</p>
  
  <p>As a piece of that, you will also want to make sure your whole site defaults to HTTPS, not just the Civi sections. Google's search results looks favorably on sites which are entirely HTTPS, and with HTTP/2 now becoming a reality for folks, the speed hit should be mitigated (somewhat).  Lullabot has a great deep dive on the topic: <a href="https://www.lullabot.com/articles/https-everywhere-security-is-not-just-for-banks" rel="nofollow noreferrer">HTTPS Everywhere: Security is Not Just for Banks</a></p>
  
  <p>As far as server practices go, keeping OpenSSL and OpenSSH updated are crucial. Closing ports that are not used, or limiting them based on IP address, is another helpful step to take.</p>
  
  <p>A perhaps obvious step to take is to double and triple check your Drupal and Civi permissions and make sure access to data is limited to only those parties who need it and nothing more. This is especially pertinent if it's been a while since the CMS and Civi were first installed. Time often creates complacency.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-18T17:39:35.077Z
Answers.LastActivityDate: 2017-01-18T18:03:34.783Z
Answers.LastEditDate: 2017-04-13T12:53:13.207Z
Answers.UserDisplayName: Allen Hutchison
Answers.Body: <p>The key operative word is ofcourse 'reasonably' :-)
  I do not have in-depth knowledge of server security or configuration but I tend to explain that the most secure setup is the one where your public facing website and CiviCRM are on separate servers. The first should be in the WWW, the second in a VPN. Ideally the two communicate via CiviProxy so you can configure which API calls will be acceptable and which not etc.</p>
  
  <p>Obviously this is also the most costly alternative, and it also means you can just use CiviCRM Webform out of the box as it assumes CiviCRM and Drupal are on the same server.</p>
  
  <p>Generally I advise organizations to check every security patch, and decide if installation is required or not. Ideally with the new LEXUM approach the security releases should not also have new and exciting functionality which then requires you to re-test some of your vital processes. But always take an informed decision on your environment would be my recommendation, not necessarily automatically install every update without doing your own thinking.</p>
  
  <p>And I would certainly recommend usign SSL.</p>
  
  <p>Good luck, share you decision with us if you can?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-18T21:21:44.897Z
Answers.Text: I'm curious to know if you found a way to run Webforms across 2 servers as you described.
Answers.UserDisplayName: Coleman
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-19T15:35:23.967Z
Answers.Text: No I wish we had Coleman! as more organizations are interested in this approach I do believe there is a good chance of getting a co-funded project together. Björn and I have tentatively named it CiviMcRestFace....
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-18T14:42:32.780Z
Answers.LastActivityDate: 2017-01-18T14:42:32.780Z
Answers.UserDisplayName: ErikH - CiviCooP
Body: <p>As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe.</p>
  
  <p>Therefore I want to ask in the round:</p>
  
  <p>Did you do anything further to protect your CiviCRM installation as:</p>
  
  <ul>
  <li>keep CiviCRM up to date</li>
  <li>keep the CMS up to date</li>
  <li>keep the operating system up to date</li>
  <li>encrypt the site via SSL</li>
  <li>block unused ports</li>
  <li>keep client computer up to date? </li>
  </ul>
  
  <p>Thanks in advance,
  Benedikt</p>
  
Tags: <drupal><security>
Title: Security approach
ThreadText: # Security approach
  
  (Asked by: username_0 on 2017-01-18)
  
  As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe.
  
  Therefore I want to ask in the round:
  
  Did you do anything further to protect your CiviCRM installation as:
  
  * keep CiviCRM up to date
  * keep the CMS up to date
  * keep the operating system up to date
  * encrypt the site via SSL
  * block unused ports
  * keep client computer up to date?
  
  Thanks in advance,
  username_0
  
  **Tags:** drupal, security
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-01-18. Score: 7
  
  Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance. There are a couple of questions here about that topic:
  
  * [CiviCRM & PCI Compliance](https://civicrm.stackexchange.com/q/10390/105)
  * [How hard is it to obtain PCI compliance?](https://civicrm.stackexchange.com/q/15857/105)
  
  Here is another helpful question/answer about security and Civi, but with reference to Joomla (same principles apply really): [Installing CiviCRM - best security practices](https://civicrm.stackexchange.com/q/8931/105)
  
  Agreeing with Erik, using SSL is at the top of the best practices list (you can check your site's security for free with <https://www.ssllabs.com/ssltest/>). With "SSL" as a practice though, you will want to adjust your ciphers to disallow known vulnerabilities. Limiting your server to just TLSv1.1 and TLSv1.2 is becoming the standard (and just TLSv1.2 is preferred if you don't need to support older browsers). Our payment vendor (iATS) requires the use of a service like TrustWave that scans our setup once per month (and ad hoc as needed) and lets us know of any vulnerabilities and updates needed to maintain PCI Compliance.
  
  As a piece of that, you will also want to make sure your whole site defaults to HTTPS, not just the Civi sections. Google's search results looks favorably on sites which are entirely HTTPS, and with HTTP/2 now becoming a reality for folks, the speed hit should be mitigated (somewhat). Lullabot has a great deep dive on the topic: [HTTPS Everywhere: Security is Not Just for Banks](https://www.lullabot.com/articles/https-everywhere-security-is-not-just-for-banks)
  
  As far as server practices go, keeping OpenSSL and OpenSSH updated are crucial. Closing ports that are not used, or limiting them based on IP address, is another helpful step to take.
  
  A perhaps obvious step to take is to double and triple check your Drupal and Civi permissions and make sure access to data is limited to only those parties who need it and nothing more. This is especially pertinent if it's been a while since the CMS and Civi were first installed. Time often creates complacency.
  
  
  ---
  
  ### Answer by username_2 on 2017-01-18. Score: 3
  
  The key operative word is ofcourse 'reasonably' :-)
  I do not have in-depth knowledge of server security or configuration but I tend to explain that the most secure setup is the one where your public facing website and CiviCRM are on separate servers. The first should be in the WWW, the second in a VPN. Ideally the two communicate via CiviProxy so you can configure which API calls will be acceptable and which not etc.
  
  Obviously this is also the most costly alternative, and it also means you can just use CiviCRM Webform out of the box as it assumes CiviCRM and Drupal are on the same server.
  
  Generally I advise organizations to check every security patch, and decide if installation is required or not. Ideally with the new LEXUM approach the security releases should not also have new and exciting functionality which then requires you to re-test some of your vital processes. But always take an informed decision on your environment would be my recommendation, not necessarily automatically install every update without doing your own thinking.
  
  And I would certainly recommend usign SSL.
  
  Good luck, share you decision with us if you can?
  
  > **Comments:**
  > **username_3**: I'm curious to know if you found a way to run Webforms across 2 servers as you described.  
  > **username_2**: No I wish we had username_3! as more organizations are interested in this approach I do believe there is a good chance of getting a co-funded project together. Björn and I have tentatively named it CiviMcRestFace....  
  
  ---
  
  