Security and Drupal Presentation Slides from Drupalcon DC

Friday morning at Drupalcon DC, Matt Cheney, Neil Drumm, Ezra B. Gildesgame and I gave two presentations about keeping Drupal sites secure: Introduction to Security and Advanced Drupal Security.

Even though it was a total of 2 hours long we left out a lot of stuff for brevity. Much of it is covered in my book, some I'll be writing about on this site.

The Security in Drupal Presentation Slides

We've provided the slides to our presentations as well:

Introduction to Drupal Security Slides

Advanced Drupal Security slides.

The videos should be online shortly. Keep your eyes here and/or on the dc2009 site for announcements.

We made a big change this year compared to previous presentations: Matt provided really hot demonstrations of how you can be pwned if you ignore these recommendations. It made it much more interesting to me and, I believe, made it much more interesting for folks in the audience.

Online Resources for Drupal Security

If you ignore everything else from the slides (they are brief after all) pay attention to the last slide in each presentation about online resources.

• Secure Configurations of Drupal
• Writing Secure Drupal Code
• Drupal Security Team
• Security Best Practices on groups.drupal.org
• OWASP
• Grendel-Scan
• Cracking Drupal (The book this site is about)

Edit: See this review for an audience perspective.