Your new house is complete. You’ve spent painstaking hours with an architect and builder to create your dream house. The cost was high, but it was worth it. However, you find that the kitchen doesn’t quite feel right once you stand in it. You want to change a few things. Unfortunately, that’ll require another project and another payout to the architect and builder.
Just like that new house, creating a website from scratch using a web developer and designer team will give you exactly what you want. But you’ll pay for it. And not only that, you’ll pay for any changes to what you built, and it’ll take some time.Content management systems (CMS) offer an easier way to manage your website. Imagine if your kitchen was a separate component and could easily be replaced with another. A CMS gives you control of your website and easily allows you to build and change content on your site at will.
However, many exist and it could be difficult to know what to look for when purchasing one, especially for those who are security conscious.
We decided to build this CMS buyer’s guide just for you security conscious buyers out there. We’ll take a look at why CMS security is important, what key features you should look for when shopping around, and some key questions you should ask before beginning your search.
Having a CMS introduces a new layer to traditional web application security. You’re now introducing a piece of code outside of your control into your environment. When there’s a security bug in that software, there’s now a security bug in your website.
WordPress has a long list of security vulnerabilities. Drupal has had two “Drupalgeddons,” and that’s only two of the many CMSs you can choose from. Is having a CMS a bad idea fraught with online dangers?
No. Having a CMS doesn’t automatically mean you’re vulnerable to the bad guys. It is possible to run a secure CMS installation. You just need to know what to look for when shopping for a CMS and what you need to do to prepare.
Every CMS differs in architecture and security features. Let’s boil all of these features down and cover the features you should look for when shopping for a secure CMS.
A key component of any CMS is an administrator panel where you can control the various aspects of your website. Administrators can create user accounts for those who write and edit content, upload images, and other basic functions.
Administrator accounts are extremely powerful and can be misused if compromised by an attacker. Make sure your CMS has the ability to protect your administrator account, and be on the lookout for default settings that may leave you vulnerable. Defaults can be dangerous because they are widely known by attackers.
For example, Umbraco uses the /Umbraco path as the default URL to access the administrator dashboard. An exposed /Umbraco path could leave your admin page vulnerable to brute force attacks. Umbraco allows you to rename the Umbraco folder to help prevent this.
When looking for a CMS, try to find one with configurable password policies, giving you the ability to enforce strong passwords for users. Look for the ability to add two-factor authentication to administrator accounts for extra protection.
A content management system’s data is the lifeblood of your website. The database holds content, images, files, as well as user accounts of your employees. Any CMS must have robust tools available to protect your data.
Data can be protected from intruders by encrypting it within the database. If the data is encrypted, then an attacker will get nothing but gibberish if they somehow breach the database. On top of encryption at rest, encrypting the data in transit using HTTPS is also essential. Redirect any HTTP requests to use HTTPS instead.
The security of data is not always about it being stolen. Your databases may become corrupted and unusable. WIthout your database intact, your website simply will not work. Ensure the CMS you choose has options for secure database backups. If the worst happens, regular backups will allow you to minimize downtime.
The database isn’t the only place data is stored. Files stored on your servers store sensitive and important information. For example, an attacker could try to change a configuration file or the main code file of a plugin. If an attacker changes a file and uses it to run malicious code, it could open a backdoor into your site and allow the attacker to bypass the administrator login. Look for a CMS capable of file change detection, so you can be notified if any files are changed. This can be native functionality, or could be provided by installing a plugin for the CMS.
The security of your site has much to do with the architecture as the software using it. Your site architecture refers to the physical and network configuration of the different pieces of the site. This allows you keep some pieces out of the reach of attackers.
If a secure architecture is important, look for a CMS that features flexibility and scalability as a core component. An example is Sitecore CMS, which gives you the ability to install the administrative pieces on a separate server from the content presentation software. By placing the content creation and administration server behind a firewall and only exposing the content presentation server to the Internet, you create a barrier between attackers and your CMS.
Flexible architecture options give you the control you need to protect your CMS without complicated code being added to it.
Resources are often constrained, and only so much money is available to spend on your CMS. This reality should factor into your decision to buy a CMS. The more effort required to secure the CMS, the more resources you need and the more money it’ll cost to get things up and running.
Figure out what it will take to secure your CMS. Will you require a special set of plugins to lock things down? Are you required to change configuration files and many defaults to secure the CMS? Are your servers full of holes and open to attack regardless of which CMS you choose?
You’ll have to decide what you’re comfortable with. With guidance on exactly what to change, such as in our article on Sitecore CMS security features or how to secure Drupal, it could take only a couple hours or a day or two at most. Figuring it out on your own may take much longer.
Sometimes all you need is a simple checklist of the biggest concerns when looking into a new technology. Here’s 10 questions you should ask about your environment and any prospective content management systems you may be looking into for your site.
Many factors should be weighed when choosing a CMS, and security is an important one. Every company has different standards, policies, and existing infrastructure, and these should affect what security features are most important to you.
A CMS allows you to switch out your “kitchen” for another pretty easily. But switching an entire CMS is difficult once you use one for a while. Take the time to carefully analyze your needs first before jumping into a decision you may regret.
Review your current security standards and policies. Look for the features we laid out to make things easier, and ask the tough questions about the CMS and your own systems to get a better picture of which CMS will fit into your environment. Then your CMS will feel like your new home’s relaxing hot tub, not a cold shower.
Never forget you don’t have to make this big decision alone. Please get in touch with us if you need any help evaluating your environment so you can choose the right CMS for your needs.