Answers.Body: <p>There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use <a href="https://docs.civicrm.org/civiproxy/en/latest" rel="nofollow noreferrer">CiviProxy</a>.</p>
  
  <p>This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues. </p>
  
  <p>My personal advice is that when it aint broken don't fix it. So that also means for updates, if your system still works and you don't need any new features keep it as it is. We are brainwashed by Android and Windows which install updates automatically and so we all think it is good to install updates regularly however I cannot think of a rationale for that. </p>
  
  <p>Also I do think that installing updates is not much work from a technical perspective. But with every update you have test your whole setup and see if nothing ain't broken. And this test work is usually quite a lot of work. </p>
  
  <p>My experience is also that the organization using CiviCRM is also changing over time. And that those business changes might also require some (minor) changes in your CiviCRM setup/configuration. And usually when doing those kind of things it might be worth to also update to the latest version.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-13T10:22:23.257Z
Answers.Text: Thanks.   Yes of course whole system will be behind firewall and encrypted at rest etc.
  
  My concern is that if the updates to core and especially extensions are not vetted - how do you know you are not installing something that will (a) steal your data or (b) ransomware it.
  
  How do I know the update does not include trojan ware - I am concerned about the vetting process for updates being released.
Answers.UserDisplayName: Simon Walden
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-13T14:51:11.120Z
Answers.Text: Because it is open source you can inspect the source code your self (or pay someone to inspect it for you). And then check whether there is any trojan horse included. 
  Generally speaking it comes down to trust. I would trust code from civicrm core and regarding extensions it depends whether you trust the extension developer.
Answers.UserDisplayName: Jaap Jansma - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-13T10:08:48.650Z
Answers.LastActivityDate: 2019-11-13T10:08:48.650Z
Answers.UserDisplayName: Jaap Jansma - CiviCooP
Answers.Body: <p>Regarding tampering of the release files to insert malware, there are md5 and sha checksums listed at sourceforge that you can compare to the downloaded file, e.g. <a href="https://sourceforge.net/projects/civicrm/files/civicrm-stable/5.19.1/" rel="nofollow noreferrer">https://sourceforge.net/projects/civicrm/files/civicrm-stable/5.19.1/</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-13T16:23:37.527Z
Answers.LastActivityDate: 2019-11-13T16:23:37.527Z
Answers.UserDisplayName: Demerit
Body: <p>Core updates are frequent, so are some extension updates.</p>
  
  <p>How frequently do people update?   All of them or only sometimes?</p>
  
  <p>Do you always up date to the latest version or pick one that is a little older?</p>
  
  <p>How do you know the update is not loaded with dodgy code or ransomware?</p>
  
  <p>Working with highly sensitive data and I am concerned about the vetting process for updates.</p>
  
  <p>Thanks in advance</p>
  
Tags: <best-practice>
Title: What is best practice for updates?
ThreadText: # What is best practice for updates?
  
  (Asked by: username_0 on 2019-11-13)
  
  Core updates are frequent, so are some extension updates.
  
  How frequently do people update? All of them or only sometimes?
  
  Do you always up date to the latest version or pick one that is a little older?
  
  How do you know the update is not loaded with dodgy code or ransomware?
  
  Working with highly sensitive data and I am concerned about the vetting process for updates.
  
  Thanks in advance
  
  **Tags:** best-practice
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-11-13. Score: 3
  
  There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use [CiviProxy](https://docs.civicrm.org/civiproxy/en/latest).
  
  This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues.
  
  My personal advice is that when it aint broken don't fix it. So that also means for updates, if your system still works and you don't need any new features keep it as it is. We are brainwashed by Android and Windows which install updates automatically and so we all think it is good to install updates regularly however I cannot think of a rationale for that.
  
  Also I do think that installing updates is not much work from a technical perspective. But with every update you have test your whole setup and see if nothing ain't broken. And this test work is usually quite a lot of work.
  
  My experience is also that the organization using CiviCRM is also changing over time. And that those business changes might also require some (minor) changes in your CiviCRM setup/configuration. And usually when doing those kind of things it might be worth to also update to the latest version.
  
  > **Comments:**
  > **username_0**: Thanks.   Yes of course whole system will be behind firewall and encrypted at rest etc.  My concern is that if the updates to core and especially extensions are not vetted - how do you know you are not installing something that will (a) steal your data or (b) ransomware it.  How do I know the update does not include trojan ware - I am concerned about the vetting process for updates being released.  
  > **username_1**: Because it is open source you can inspect the source code your self (or pay someone to inspect it for you). And then check whether there is any trojan horse included.  Generally speaking it comes down to trust. I would trust code from civicrm core and regarding extensions it depends whether you trust the extension developer.  
  
  ---
  
  ### Answer by username_2 on 2019-11-13. Score: 0
  
  Regarding tampering of the release files to insert malware, there are md5 and sha checksums listed at sourceforge that you can compare to the downloaded file, e.g. <https://sourceforge.net/projects/civicrm/files/civicrm-stable/5.19.1/>
  
  
  ---
  
  