Answers.Body: <p>CiviCRM is a good system if you want your data to remain secure. I would recommend installing on a hardened server following the normal instructions, and ensure you keep the security patches for your CMS and CiviCRM applied when they come out. Drupal, WordPress and Joomla! all have security announcement lists you can subscribe to. See <a href="https://civicrm.org/security" rel="nofollow">https://civicrm.org/security</a> for CiviCRM's.</p>
  
  <p>During configuration you will want to ensure that the permissions are configured to prevent inappropriate access to data (eg see <a href="http://wp46.demo.civicrm.org/wp-admin/admin.php?page=CiviCRM&amp;q=civicrm%2Fadmin%2Faccess%2Fwp-permissions&amp;reset=1" rel="nofollow">http://wp46.demo.civicrm.org/wp-admin/admin.php?page=CiviCRM&amp;q=civicrm%2Fadmin%2Faccess%2Fwp-permissions&amp;reset=1</a> after logging with user demo password demo). For example, CiviCRM: view all contacts and CiviCRM: edit all contacts should be reserved to Administrative users, and CiviCRM: skip IDS check should be disabled for all users (IDS is Intrusion Detection System).</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-09T16:24:10.460Z
Answers.LastActivityDate: 2015-12-09T16:24:10.460Z
Answers.UserDisplayName: Joe Murray
Answers.Body: <p>I think this is more a question on how to set up your configuration (which I am no expert on so I will not get into that) rather than programming in CiviCRM?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-10T23:48:21.623Z
Answers.Text: Both configuration and programming.
Answers.UserDisplayName: John Willis
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-09T11:51:02.423Z
Answers.LastActivityDate: 2015-12-09T11:51:02.423Z
Answers.UserDisplayName: ErikH - CiviCooP
Body: <p>I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of value they  are trying to protect is user real name and email address. But, they are considered very sensitive and high value. No money is exchanged with users. Their activity history is not considered sensitive, just the fact they are associated with the site. There will be millions of users and high site visibility.</p>
  
  <p>Thank You</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-12-09T16:24:37.987Z
Comments.Text: You might want to be more specific about the kinds of nitty-gritty details you want to know about.
Comments.UserDisplayName: Joe Murray
Tags: <configuration><security>
Title: Security Configuration and Programming Guidance
ThreadText: # Security Configuration and Programming Guidance
  
  (Asked by: username_0 on 2015-12-09)
  
  I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of value they are trying to protect is user real name and email address. But, they are considered very sensitive and high value. No money is exchanged with users. Their activity history is not considered sensitive, just the fact they are associated with the site. There will be millions of users and high site visibility.
  
  Thank You
  
  **Tags:** configuration, security
  
  > **Comments:**
  > **username_1**: You might want to be more specific about the kinds of nitty-gritty details you want to know about.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-12-09. Score: 1
  
  CiviCRM is a good system if you want your data to remain secure. I would recommend installing on a hardened server following the normal instructions, and ensure you keep the security patches for your CMS and CiviCRM applied when they come out. Drupal, WordPress and Joomla! all have security announcement lists you can subscribe to. See <https://civicrm.org/security> for CiviCRM's.
  
  During configuration you will want to ensure that the permissions are configured to prevent inappropriate access to data (eg see <http://wp46.demo.civicrm.org/wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fadmin%2Faccess%2Fwp-permissions&reset=1> after logging with user demo password demo). For example, CiviCRM: view all contacts and CiviCRM: edit all contacts should be reserved to Administrative users, and CiviCRM: skip IDS check should be disabled for all users (IDS is Intrusion Detection System).
  
  
  ---
  
  ### Answer by username_2 on 2015-12-09. Score: 0
  
  I think this is more a question on how to set up your configuration (which I am no expert on so I will not get into that) rather than programming in CiviCRM?
  
  > **Comments:**
  > **username_0**: Both configuration and programming.  
  
  ---
  
  