Hi there. Thank you for joining ad week together. My name is co-im. I'm the community editor and podcast co-host We are so happy to share all these conversations with you, and we hope you're enjoying them, too If you are valuing this type of content We ask that you sign up for our subscription at ad week comm slash offer And you can get a pro subscription from there and have access to all of our essential content and resources for marketers and advertisers and partners worldwide Without further ado today, we are joined by a very dynamic and special guest We have Amanda gets VP of marketing at the knot and the wedding wire. Happy Thursday, Amanda. Happy Thursday, co I'm excited to be here This is gonna be a great conversation about marketing at all levels marketing through the crisis I want to start with You know the wedding season is upon us right supposed to be upon us June going forward. So I guess Looking back at when the pandemic really started to hit us What was your thinking with the teams that you see across the wedding wire and the knot? How did you start to to strategize at a very high level? Yeah, I mean this happened so quickly it was that week of March where things started to Start to shut down But we didn't know if it was going to be shelter in place and then one morning we woke up and it was shelter in place And so we had couples all around the US and all around the world That had to postpone their weddings immediately and so as a brand marketer We had to really Reprioritize our goals, right? Rather than talking to a pre-engaged audience and being a relevant brand for people and be top of mind We had to come up with a whole suite of Resources and services we opened a 24-7 hotline To service the couples that needed us most and That was to make sure that they knew how to postpone their wedding. What was the latest CDC? We were updating in a One piece of content like 20 times a day It was just constantly being updated and then we made sure that we were being super sensitive And so our social channel just turned a hundred percent to be there for being empathetic and just being a resource rather than talking about Inspiration and getting people excited or memes like we had people Really really in like a heightened emotional state at that moment and we wanted to make sure we met them there Yeah, especially because this stage in life is already such an emotional stage so I Guess I know that when I went to your site I just saw a lot of resources a lot of COVID-19 kind of tagged pages and verticals Now I guess, you know, are you going back to that kind of inspirational? Positive branding or are you also trying to stay very service oriented? How do you kind of balance that? It's definitely a balance But we are starting to see couples who are thinking about what a wedding during COVID does look like like we saw Elaine from through Vogue if you followed Elaine what what works Stoop wedding in Brooklyn like people are figuring out how to still have their weddings right now And people want to be inspired by that content But there is a reality of some people are postponing and they still need the resources of how to communicate that how to order change the dates So it's a balance of empathy But we are starting to see and we're listening to our users and even just asking them in community forums If they're ready for to be entertained again or for a little laugh And so a lot of it across the are you know owned? Brand channels has been testing and seeing what is resonating and as we start to see people Really wanting to be inspired by some of the stories of couples who are navigating coven That's working but then also like the reality of being at home with your significant other and what that Brings to the table. There's also fun But then we're leaning on relationship advice and we have an amazing app called lasting that helps with you know Relationship health so kind of meeting people where they are both inspiring them But constantly being there with resources when they need us Yeah, we hear a lot about, you know, this is the time for experimentation. This is the time for listening I know you've been at your current position and the company for five years Has it been more difficult for you as you know a strategist as a thinker? Yes, I mean this has been a joke like I've planned personally over 150 weddings I was a wedding planner two lives ago and I've never had to think about weddings in this new light So it's like a moment of like a change in a cultural tradition like how we think about what does a ceremony look like? What does a reception look like in a world of social distancing? And so the past three months I feel like I've worked more than these past three months than I have in three years But it's also forced us to really rethink like how we speak to our users and and how we approach them and What our brand can be for them and for the industry? So it's been Both the stressful time, but also a really motivating time I think for our teams internally to the Inbound messages we get from couples when we've helped them navigate this really stressful time Are we have a slack channel that we're constantly showing when a bride is like I don't know what I would have done without your community specialist who talked to me through and stayed on the phone with me for You know an hour an hour and a half to just help me figure this out. So that's like been pretty rewarding Yeah, what's also been like we know that what's been important is you know community and You know external relations and customer service for many brands and companies and consumers Have there been other any surprising things that you've seen any trends even immediately that you've noticed with couples With couples with branding just industry-wide even and I also do want to say I did see that Elaine wedding and just beautiful way to have you know a flower wall on your stoop and it was very inspirational and emotional to Kind of experience that with her, but sorry go ahead stunning like we are all just like amazed by it, but So I think across the industry a couple of things I noticed when COVID first started to to happen and the shelter-in-place happened. It was fascinating I was doing teardowns of all the top brands to see What they were doing on their social channels like who was going radio silent who was putting up a COVID message Who was kind of business as usual and then so I think that there was this immediate response of like People need to hear from the CDC. They don't need to hear from us like what are we gonna do, right? Then it was this shift to how can we help? And that was really interesting. So we're two-sided marketplace. So we obviously have Hundreds of thousands of small business owners who rely on weddings happening And that was important for us to make sure that we were there for them on the B2B side And watching like Verizon's pay it forward and all of these, you know Brand campaigns that come to life just to show like we see you and we have the opportunity to make a difference right now And it it was really fascinating to watch like The the brands that did that authentically It really resonated really well. Um, so now I think we're starting to phase into People are slowly adjusting to this like new normal. I hate that phrase, but um, So how can we be there to entertain provide great content again and um be the brand that people will like remember you to be Yeah, and as we kind of look forward and I also hate that phrase the new normal for some reason And I have a a calendar saved the date for February for a wedding in in Argentina But what are kind of your predictions, you know, um for the industry and for weddings going forward Are we're going to continue to see creative solutions from both sides of the market and um with consumers? Absolutely, like the vendors are getting oh, sorry. There's someone at my door Life is still happening Um, but yeah, we are definitely seeing creative solutions vendors are coming up with like satellite dance floors or you know blocking off major parts of their outdoor space to allow for Standing ceremony viewings. So you're not sitting close to each other There are so many ways to think about still having a wedding We're talking about a new term called the shift wedding Where you have your guests in groups of 25 in three different rooms. I'm sorry. I'm going to walk and get this because I think she's going to keep knocking I apologize everyone. This is real life Oh Yeah, I mean, um, that's a really interesting concept about Shifting and uh, you know having people That you know, you almost bring in the idea of experiential into Individual experiences. So that'll be interesting to see what people Bring in conceptually uh from a marketing standpoint and from a consumer standpoint Yes, definitely like like I was saying we have been promoting that weddings are still Going to continue to happen for all of our vendors and for couples too There are so many couples in the stage of life that you know Want to continue to have these moments and they don't want to postpone them So it's our job to make sure that we give them all the inspiration ideas how to make it their own And it also goes into experiential marketing, right? We've been talking about how our influencer events are going to change in the next year We we we bring our most influential weddings couples together for influencer activations throughout the year What are those going to look like? Are we still going to do those? So there's lots of things to think about in this new world of social distancing, but Yes, absolutely. And I also want to turn the conversation To your kind of internal teams and your leaderships there as you're Um You know trying to to manage all the zoom meetings and the back-to-backs and people's, you know, very real emotions at home People's emotions about work even What are some tips that you have that you found that have worked for you and your teams? so The biggest thing right now is empathy and trust and clear communication so Communication I think was the biggest thing for us because we woke up and all of our marketing plans were just done like we weren't going to continue to do Plans that we're celebrating weddings because weddings weren't happening at that moment. So We started this thing where I would do an Like a email that was just my thoughts at the beginning of the week And a bookend email on fridays of what we decided and what was happening So those became major kind of tentpole communications for my team Then we started to do daily stand-ups to just say what's what's the 10 minute update that everybody needed to know So that over communication helped immensely Right in the beginning when everything kind of was in flux, but then we started to consolidate that to um What's our clear goals moving forward once we actually had a handle on what our brand was going to do and what We're going to be saying Then it was important to kind of Create an actual strategy and okay ours for the rest of the team Because everybody down to like a coordinator level needed to wake up and know How does my work affect what we're doing as a brand and how can I impact that? Because it was a lot of anxiety right if you wake up and you have nothing to do You're nervous about that So it was communicating communicating all the decisions then making sure everybody understood what their new job was And that meant a lot of shifts to be perfectly honest I had consumer marketers that I shifted over to help social and be responding to dms So everybody just had to be very flexible And then the third thing is just empathy and trust so as a single mom I have only from 10 to 4 p.m Where I can actually be on zooms because I have to teach first grade in the morning And then I got to be on dinner and bedtime duty at in the evening So people are now understanding that I need to just communicate what's working for me And then trust that I'm going to do the job that you are trusting me to do and that actually has been the silver lining of this whole thing Yeah, I really enjoy the transparency and I like the idea It sounds so obvious and simple but the idea of the monday and friday emails because it really provides Clarity and direction and closure from the start of the work week and the end of the work week So I do like that idea a lot and I appreciate your honesty You know with with everything. I want to go to some of our comments on linkedin First of all, we wanted to know the update on what the delivery was. Who was at the door? So I'm at an air bnb and it was amazon. I didn't know that they just didn't Set the package down There's a great tiktok about all the different delivery workers and how they deliver packages I will try to find it and send it out. But yes, it was My nespresso capsules from amazon that I so desperately need for my coffee Oh, yes, I I really enjoy those capsules a lot and we need more coffee drinking a lot of coffee at home, though Samantha commented and said it is a beautiful time for innovation and then mary as um, and maybe this is For a friend or for herself, you know, what are the best consumer options delay until next spring mary quietly now Throw a party on your first anniversary. I know you're not, you know, uh, you did plan weddings But you know, what's kind of the expert advice would you give now? Yeah, hey mary. I'm sorry. You're going through all this. I'm sure it's a stressful time But honestly, there's no one right way to do this and we do see a lot of couples doing mini monies right now Where they're getting married privately and in their homes And then they're planning the big celebration and wedding and reception with all their friends and family I have my best friend is choosing to just do a 25 person wedding because she Is like ready to start a family and she you know wants to keep the show on the road But then I have three people that report to me that postponed it till late 2021 So we're seeing everything and so you just need to figure out what Honestly is right for you and don't feel guilty about anything do what works best Yeah, I think um, we also have to extend that forgiveness and understanding and flexibility to ourselves Absolutely. I think that's the hardest one, but absolutely.  If you have time for that How do you clear your head? Yeah, so I get up early and I go for walks when I can or a run if I feel motivated That is my morning time and I don't allow myself to use technology during that time Because I want to see where my brain goes. It's kind of like meditation, but I'm not very good at meditation to be honest So I do walks and I see where my brain goes during that time Then I usually come back and I always have Like I call it this like power hour list, but if I set aside one hour before I open my email What are the big things that I want to kind of be on offense for like what strategy do I want to think through? That's during my like I have my coffee. I feel zen. I just went for a walk Like let me knock something out so that if I get nothing else done the rest of the day I moved one thing forward And then I go into how can I support my teams? How can I help remove roblox for them and be in meetings? And during that time Just navigating the mom life Yeah, yeah, absolutely. I want to get one more question from our linkedin audience um Ruth asks what can a catering company do in order to market for postponements or virtual weddings? I know you mentioned, you know working with small businesses and thinking really about b2b as well Yeah, they should definitely reach out. We have an amazing b2b marketing team That is just on our wedding pro community. So she doesn't already connect with the wedding pro blog So many vendors are doing q&a's there of just like what they are doing to reach couples and how they're rethinking If she if she's a caterer. I think you said, um How they're thinking about incorporating like plexiglass and in different ways to serve the foods that way people feel really good about Going to an event Great. Um, and I know that in our pre record pre conversation we talked about tiktok a bit Are the wedding wire and the knot uh on tiktok and what's kind of your hope or strategy for that? So i'm a huge fan of tiktok huge fan of co on tiktok to be clear So it was interesting like tiktok has evolved so fast in terms of their demo Over the past six months right like six months ago It was not millennials on tiktok and now that we're starting to see more and more millennials come to the platform And the the age the median age skew We are definitely starting to think through ways to partner with other brands, but also Reach influencers that are organically on tiktok So we have a couple right now who had to postpone their date and they're using tiktok Their tiktok audience to pick their new date Which I think is really fun. Um, we're thinking about future dance challenges because as people start to attend weddings You know, i'm guessing guests are going to know the savage dance. So Are they going to perform it at their wedding? Maybe let's see. So lots to come there, but I definitely see it as a An opportunity to just continue with brand relevance not necessarily acquisition Oh, yeah, that's a good thought maybe in february I will have to reprise the the savage dance on the floor Or maybe people make, you know, virtual videos and string them together. Who knows? I do want to give you one, um, random question Yes from myself a millennial on tiktok. Um okay I don't have my deck of cards, but uh If you were a color, what color would you be right now and why? Oh I would say white because when light hits it, it's all the colors right white is a Um, comprisement of all the colors and I think right now More than ever, I feel all emotions at all parts of the day And so I can't pick just one ever. I have to just allow Um, that speck full spectrum to be a part of me. So I would say white White that's very on brand two Um, um, I just want to ask one more question because it's not for me Um, we didn't talk about honeymoons. Jonathan's asking. What's the trend as states have phased openings? Are you guys watching everything closely the news closely? Um about that and and guiding people that in that way? Absolutely. So many moons are Had been a thing progressing that people were taking small honeymoons right after their wedding That were close by and just like a weekend getaway and then planning for That big exotic vacation a year or two down the road We're seeing that go Even more right like people are still Figuring out how I can get like an Airbnb in the mountains or at the beach And social distance but still get away and celebrate even on their original wedding date. We're seeing that So I think many moons are going to be on the rise and then when it's safe to travel people will do their big honeymoons then Great. Well amanda gets a VP of marketing at the knot and wedding wire I hope we will get to see each other in person sometime soon And then I want to thank you Uh for your time and your insights, of course. Thanks go And for all of our viewers out there, thank you for tuning into another episode of ad week together for the rest of the series you can log on to adweek.com slash Adweek together and then tomorrow Please join us as we have agency supporter minda smiley speaking with alan trinkel president of m-6 about positive dynamics in the Home workplace and of course if you value our conversation center journalism head to adweek.com slash offer For your subscription and access to all of our content. Thank you so much and have a great thursday


Hey friends and happy holidays tonight. I am at Disney's contemporary resort earlier this week They sent out a message to all the guests staying here that they are gonna be testing fireworks at Magic Kingdom from 10 30 to 11 30 So we had plans to actually come out to California Grill to try all their new seasonal offerings And we decided tonight would be a perfect night for it. So let's go do this I'll be joining up with a friend tonight. I just need to find her somewhere in the contemporary Hopefully we'll meet up sooner or later Oh, hey, oh Yeah, have a great one see ya Actually Well, yeah, I was coming to find you not too sure if we're gonna make it to the Magic Kingdom It's looking a little rainy out and a little monorail Riding by right now. Take a look at the sunset happening behind the castle though. Isn't that beautiful? I really love the way that looks right now because it is gray skies But there's just one thin line of red that just makes it look beautiful I had to give you the zoom-in shot just so I can show you a little bit better how cool it looks Since it is a little bit rainy out we're gonna take the monorail Maybe take a pit stop at the Polynesian and then see what it's like when we get to the Magic Kingdom It's gotten real dark out. I just don't want the rain to be here I'm stuck between two monorails. Look how cool. This is I love it Magic Kingdom does close at eight o'clock and it's now seven o'clock So like I said, we're gonna stop off at the Polynesian and then even if we can just duck in the Magic Kingdom Just to say hello. That's all I'm happy. I'm happy for just the littlest things I'm happy just to say hello to Main Street USA Cinderella castle the Christmas tree just a quick hello and then bye and then be on our merry way And if I can't make it into Magic Kingdom We're just gonna actually take the monorail right back over here and get ready for our California grill reservation at nine o'clock Looks like it's just a light drizzle But we're gonna have to walk to the Polynesian from the TTC If you remember they actually have the monorail ramp closed there The reason we're actually gonna make our journey over to the Polynesian is because if you recall a couple weeks ago We did a holiday themed monorail crawl and when we got to the Polynesian They didn't have any holiday drinks, but now they have a holiday hot drink and I'm excited to try it So hopefully it's available. It was only about a two-minute walk But we are in the great ceremonial house and now we want to find the hot holiday beavers they have I don't know exactly where it's at, but we'll figure it out. Oh And this is where it's at. This is kind of a strange location for the nature to be selling it I thought they would sell it at Tambu Lounge, but actually I think it's a regular here And here it is the Tiki-Tati a Polynesian spin on a holiday classic a blend of rum cranberry juice lime juice Served warm look at that. That is the Tiki-Tati. It looks so delicious actually coming out of there Look at the fire burning underneath it.  Well the Tiki-Tati now I normally have never had a lot of hot Tati's before I've recently just started drinking them So a Tiki-Tati. I don't know. Oh It's like very Tiki-ish I would say I don't know how to explain it It's like a hot beverage, but you can taste like lemon and like it's like Hawaiian flavor honestly It's not too bad But as we were sitting here, I noticed this sign over here. They have a new trader's Sam mug that just came out I think I need to get it. It's a limited time being sold at the Tambu Lounge I mean we're here right now. It looks like they only got maybe less than a hundred back there left Holy moly. They really do only have less than a hundred. I gotta get one. I Had to get that mug. I just was talking about how I've been actually growing my Tiki mug And this would be my first first edition purchase where I actually got it for the first edition like other ones I had a buy-off resellers, but I bought this today. I feel good about that Look at this. Here it is. It looks so beautiful doesn't it and I'm right at the bottom there First edition I'm so happy It cost $32 for that mug and it actually came with the drink on the side now I didn't finish my Tiki Tati So I'm like double-fisting it at the moment, but I want to find out what's inside this drink here So earlier I was trying to read the Tiki Tati sign and then I stopped abruptly because I came to award that I knew I was not gonna pronounce right, but Jackie, please fill me on what that big F word was Big F word. I believe it's phalernum. Phalernum. Correct me if I'm wrong, but I believe it's phalernum. I believe it's bitter and I believe both of these drinks Since we actually ended up getting two drinks here at the Polynesian I don't think we're gonna make Magic Kingdom and it's okay because like I said the big thing that we wanted to come out here to do today was see if we can catch those fireworks and possibly try the seasonal drinks at the California Grill and now we're actually trying two more seasonal drinks So this is like turning into kind of like a little bit of a holiday monorail crawl, but just a modified version of it But with that, I think we are done here with the surprise drinks at the Polynesian I'm gonna take my Tiki mug and we're gonna get moving along here and Since we're actually already at the Polynesian. I think we're actually just gonna walk to the Grand Florida and get the monorail from there I think it's a little bit closer You know I mean depending on where you're at at the Polynesian if you're at your hotel rooms I feel like those are closer to TTC, but I think it's the same distance So we're gonna head over to the Grand Florida from here catch the monorail and head back to the contemporary for a reservation at California Grill As we were walking over I noticed the gates were open for the wedding pavilion And I've always wanted to actually walk across this bridge and I never have so I might as well do it now. Look at us. This is like so amazing right now the lighting everything's dark around us Unbelievable I'm excited just to see what's back here Look how amazing this is Absolutely stunning Disney fairy tale weddings Look at that They actually have like an espresso machine over there Believe is on the doors and This right here is where the actual ceremonies take place You can actually see look at the rings as the handles Wow, this is beautiful. I don't want to Open the doors or even try. I'm happy that the gates were open so we could take a peek see but I'm happy. This is a place. I've never been before. Look at that mirror how it has stars on it Very classy This looks like it's the outdoor ceremonial area and take a look at this directly Right there in the castle straight ahead. This is so awesome. I Really like being in places that I've never been before and the doors are actually open So we actually talked to a couple of people that were walking through here. They're actually getting married and They're very excited and I was like wow. I'm just so fancy. I feel like this is awesome That was a unique experience. I'm so happy now I don't normally know if the gates are open and people can just come tour it but today I guess We were just lucky or maybe I just never noticed And if you're at the Grand Florida and you can't just pass by without actually showing the tree because it's so beautiful Look at how beautiful it is The 12 days of Christmas is represented on that tree Five golden rings I wish we could have actually stayed at the Grand Floridian a little bit But like I said, we have to get to our reservation. Here comes not a real lime Hey friend And we need to get to the contemporary like I said because nine o'clock for our reservation We don't want to miss that because that's also where we're gonna be watching the fireworks from if they happen Yes, the water pageant the water pageant lights are on You see them At least we can see the Magic Kingdom though There she is. What do you think about all that scrim above the train station? Oh Boy now we got to get the iguana down and get out How awesome was it though that we were able to see the lights from the electric water pageant, right? We both got really excited. That was yeah, we did it was fun. I want to see it out there in the water. Yes Thank you. We made it Thank you. Bye All the way up to the 15th floor, please first class service All checked in we're getting our spot I'm very happy that we're actually on this side I've never sat over here before and this is perfect because if that water pageant does take off This is where we want to be Now that we're actually at our table the holiday cocktails, they don't have any literature for them yet But she's going to find out what they are We're gonna get it regardless because we want to try it That's the main reason that we came to the california grill But they also told us that they're closing down the observation decks at 10 o'clock So we can't see the fireworks from here. So we'll have to go to the spot that we normally watch it And normally they do have them open But because of the social distancing they don't want everyone just going out there and you know, it's fine I understand that completely. Luckily. We always have a plan in place and we have a spot that we normally do We just wanted to switch things up a little bit tonight and uh, yeah, so we're good The holiday cocktail that they actually have is the ice wine martini It's belvedere with some kind of vedelle ice wine Flame raisins on the vine. This seems very fancy, but they also have california grill signature cocktail, which is 137 dollars Wow one day. I will try that cocktail But not in the near future Or anytime soon And here it is the ice martini Cheers I'm excited to try this. I have high expectations. It seems very fancy. Mr. Belvedere agrees Well, it doesn't taste like alcohol I think this is gonna be very good.  Yep Smells like wine I actually really like it. It does feel like I'm drinking ice Ice Yeah, that just happened. Oh no, it's staying in it's staying in And now I think we need to go find our other spot so we can get in line to actually watch the fireworks They're about 20 minutes away or just to test the fireworks And we have arrived at our special location What do you guys think? I think we got a good view. This is where we watched the fireworks Last time and we'll also see the water pageant if they actually come out Like I said, I don't know what to expect from this tonight. We're just on like a hope and a prayer But they did have the lights on we did see it Either way, there's gonna be something happening between 10 30 and 11 30 and we've got a good spot for it Honestly, if there's absolutely no fireworks happening tonight, I'm just so happy that we've had so much fun I mean I was kind of holding off on filming some stuff because I didn't know how long We would be waiting and also at the california grill I thought we were going to be there for a much longer than we were But the fact that they were closing down the balconies at 10 o'clock We had to like change up plans This is where we normally do watch the fireworks right here at bay lake tower because it's just such an open spot It's just me and jackie here and we have like kind of the whole place to ourselves So it's really enjoyable and it's a good view and like I said, even if there are no fireworks It was such a great night Take a look at this little diagram here. This is where we're actually standing Then if you look out you have Cinderella castle Then you have splash mountain big thunder mountain space mountain the monorail The grand floridian and then this is also the wedding pavilion where we were actually walking around tonight How cool is that and I'll just show you a little bit over on this side Oh, I love it up here so much Another thing while I'm up here. I remembered I actually want to say a big happy birthday to my friend grace and 10 years old buddy Thanks so much for watching the videos. I hope you enjoy the fireworks when they happen And something has already happened. Oh, did you just see that? I think you guys caught it actually, right? The castle turned off and then it just turned back on that was really awesome that I was filming exactly at that moment They happened well before 10 30, but I just caught a little bit I believe it is uh only 10 26 so the the actual notice said 10 30 to 11 30. So now we have to be on guard on guard It's happening again. Oh boy So much fun though, we did get to catch some fireworks I feel like that's a win and I just had an overall an amazing time tonight. Isn't this beautiful? I absolutely love it out here.  I enjoyed making it. We'll see you next time. Bye


Welcome to securing your Drupal site hopefully that's what you're here for You're here for securing other stuff. Maybe this is relevant to you But if you're not here for security, then then we've got a bigger problem So my name is Greg can Addison and I'm a member of the Drupal security team and very interested in security Yeah, these slides are online by the way, and there's a link at the bottom there We'll also tweet about it after the presentation So I'm a Greggles on Twitter Greggles on triple or Greggles on IRC I've been working with Drupal for a little bit over eight years now or a while of eight years I've been working with secure with the Drupal security team for most of that time I wrote a book a couple of years ago called cracking Drupal Don't be surprised by or thrown off by the fact that it's mostly about Drupal 6 because it is still relevant to Drupal 7 and Drupal 8 amazingly enough We'll talk about the changes, but most of the things got easier and the principles still apply I work at card.com. We're a mobile alternative to a traditional branch bank and we are like so many people hiring but if anybody is interested I'd be I'd love to talk more about that And I'm Stefan Koskett. I'm score on Drupal.org I've been with Drupal for eight years. I'm a member of the Drupal security team I'm into the RDF modern core and I also work in the Semenewebin Contrib I wrote a couple of chapters for the definitive guide to Drupal 7 and I work for Acquia and we're also hiring So we have lots of things to cover today, although we will only touch lightly on most of them This is just an hour session. So we'll talk about server environment server config personal best practices Drupal configuration a bit of code and Yeah, that's pretty much it. So we start with some general tips Whenever you use any kind of protocol You should you should try to use the secure version of the protocol. So not HTTP, but HTTPS SSH instead of ternet and SFTP instead of instead of FTP You should enforce if you care about your site and your Properties you should enforce a strong password privacy So that your passwords are not easily Gassable Make sure you also your servers your lamp stack is secure on your production and any kind of stage environments and If you maintain if you manage your own hosting There's a trick you can require SSH keys and not let users connect to your servers using a password. So This is all configurable on your servers Another best practice is to take and especially verify that that your backups are actually working And there's also a link in there to show you how to sanitize your backups if you want to share them With your developers and you have data that is private more tips Keep an eye out for your roles and permissions on your sites Make sure you don't grant two higher permissions to to untrusted users and Other tips to keep your sites your site sitting secure So look at permissions Yeah, the text formats can also be made insecure. They they are by default secure out of the box in core, but if you go and change the settings, which oftentimes you have to Be careful not to not to open security holes in your Text formats and we'll talk a bit about that there If you're using triple seven Guess nobody's using triple eight yet Make sure you don't have the PHP module enabled it's not a best practice really but Some people still use that and If you if your site if yours if your site get hacked and some of the access to the admin account they can then Penetrate your site by running PHP and There's also there are some modules contribute that also execute PHP using the adult function So that's that's not good keeping an eye out for that for those. I think it's like some editors to that so So here is a list of modules With links so again, you can go and check out the slide here all the links are Live so you can read more about each of those modules but secure login Enforces HTTPS on your user login form Primalia is to Threaten your site settings and it makes sure for example that people cannot turn on the PHP module Another thing that some people do is they remove the PHP module from core and charity on their on the code code base Security review Greg will do a demo of that later permissions lock it's a way to Make sure nobody even if you know not even the site admin can change the permissions on the production site yet You have you're maintaining those permissions via code. It's a bit like CMI interpolate or or features so That's also in a good a good module if you want to you're worried about security TFA or two-factor authentication that's Module more and more popular now It's what same same as what Google offers of github You basically have to provide two two kinds of authentication before you can get access to your site So oftentimes like I have a nap on my phone that that When I log into my site, it's gonna ask me for a token even from my phone. So Hacked is a module that will scan your all of your country modules and make sure none of them were hacked And it does that by just comparing the code from your code base with the code from contribute on triple the log and password policy I mentioned mentioned that earlier so You can enforce a specific password policy or certain level of password policy when your users Create a password on your site So these are all contrary modules. You can download it from free from triple the log so they are also All their other aspects when you're considering Making you know securing your site Think also about hosting so it's not only a matter of having a configuration a triple configuration bulletproof You can get hacked if you're underlying stack is not secure, but There are some hosting companies out there that can help you with that So plenty on is one example They provide an interface where you can Maintain your code these obviously they they have all the all the They keep they keep their servers up to date and they keep the stack up to date when it comes to Linux patches and stuff like that but they also have an interface to allow you to keep your Drupal core up to date whenever there's a new security release Which happens every few months, you know So they have a nice UI that makes it very easy to merge upstream changes and patches Acquia cloud is another product And insight is in particular is a tool that lets you kind of do an analysis of your State of security in your code base and in your configuration on your site So it will go into database and analyze all the settings that you that you have on your site And it will give you a score Whether or not you're very secure and it will also tell you how to fix things When you're when you have wrong settings or insecure settings And there are many other hosts entrepreneur dog. You can go and check them out So Like I said All of these hosts and most of them are tuned for performance, but also security when it comes to Drupal So all the file permission and all that that's taken care of for you You can also subscribe for services where The company will manage your security updates for you So that's one service that Acquia offers. It's called remote administration. And so you can you can subscribe for that So you don't have to worry about the updates yourself, so we wanted to throw in a few acronyms here So this just to remind you that depending on the kind of sites that you host and depending on the kind of content that you That you have on your site You might fall under certain regulations So if you have an e-commerce site most likely you have to comply with PCI So there's a there's a link in there for PCI compliance report That was written by someone from the community so I'll check check it out if you're if you run an e-commerce site and Do we have anyone in the room? dealing hosting and keep a keep an environment Dealing with so this is generally having to do with healthcare data Any kind of personal data? There's also Fed ramp fees my certification accreditation. That's for the government Again, some some hosting companies can provide this kind of regulations. They have those built-in. It's part of the contract Anyone knows What's got eyes or One person and using Drupal first get in a scat environment Okay. Yeah, it's not it's not so common then So It helps to think of security as a process as opposed to a feature So it's not something that you can think of Once and then forget about it It always have to be in your mind checks every now and then monitor So it's an ongoing maintenance It means that You also have to plan for it. So you need to have a budget for security when you plan for your project You need to plan hours for your developers and also resources for You know servers and all that like a proper hosting infrastructure and You know many chose thing can offer that if you can't you don't want to think about it And also when it comes to Drupal and and the code basis of all the contrips and core Drupal that all coffers are packaging infrastructure. So you should definitely take advantage of that. It's free and it can Let you know whenever one of your modules one of the modules that you're using is out of date and has a new security release. So That's part of core actually you just have to turn on the update module so So Drupal has its own security team. It's composed of volunteers and so Greg and I and Michael sitting here in the front a part of the team Oh So our role is to keep Drupal's code secure In core as well as in contribe So we work with the community and we try to Educate the community on the best practices when it comes to security and that includes developers obviously But also the site builders the site admins the users the decision-makers it concerns everyone so You keep everyone needs to be kept in the loop and that's why we have security advisories for every Security release every time a module gets a new update and your release because of a security bug We rather an advisory for it. So There's a new graphics here. I won't go into detail, but I invite you to check it out later there's a link at the bottom of the slide, but Essentially it illustrates the workflow of what's happening inside the security team. So at the top Basically the first step is we get reports from people who found Who think I've found a Renovated in the module in core or in contribe and They send us an email or the file of a ticket in our issue tracker So we'll take a look and if it's a valid report we'll contact the maintenance and We'll work with the maintenance to get them to fix their module Whether it's a pro site scripting or any kind of issue with security It's not a security issue then we'll invite the reporter to File a bug on triple the law and then once we've we've worked with the maintainer to come up with a good approach to for fixing the bug will Do us an advisory and we'll do a release and everyone is invited to Upgrade their modules. So So I wanted to you know, this this presentation is for site builders and we wanted to talk just a little bit about some code elements and And as we were looking at different vulnerabilities and which ones were would be worth talking about You know, there's the OWASP top 10 Which is what the open web and application security project feels are the top 10 most important issues that are facing the world and I think within a framework We have to take a slightly different perspective about what is the most important because the framework can provide some benefits and protections That make it different from just working on a web application in general. So this is looking at code vulnerabilities from all time and if you go by this list Cross-script scripting access bypass and CSRF are the most important issues I think it's it's also interesting to take a look at it in terms of Vulnerabilities as a percent of the total vulnerabilities over time So one vulnerability that we're not gonna talk about today is sequel injection Which is a super important issue because it can be really damaging to your site But what is really interesting to me about this graph is that sequel injection, which is in in green it goes from 50% in the first year that advisories went out from triple.org It's gone from 50% to basically zero percent. So I mean that's Let's see. That's up through October of last year. I think it is so that's in 2013. There were basically zero sequel injection vulnerabilities So we I think that basically what that really speaks to is the strength of Drupal's database API and Particularly the database API in Drupal 7 which has just made it so much harder to create a sequel injection vulnerability What we what we can also see is that you know cross-site scripting has been a problem and continues to be a problem Score we'll talk a little bit more about that later on and what we can potentially do with twig and Drupal 8 to try to address that We we can also see that cross-site request forgeries, which is you know, relatively new Or sort of newly described newly discovered issue It's been around for a long time, but people didn't really think about it until fairly recently So that's sort of like came on to our radar in 2007 And it became bigger and bigger and is sort of trailing off now because I think that the patterns for dealing with that are more Well-known and people sort of understand it a bit better in Drupal 8 There are some improvements that again you'll see more about that later and then access bypass is increasingly a huge problem for us So I think that that's something that we'll have to try to address in future revisions of Drupal core So the three that we're going to talk about three big ones cross-site scripting CSRF and access bypass So cross-site scripting is some sort of XSS is cross-site scripting It's some sort of code that is running in your browser people often talk about it in terms of being javascript But it's not necessarily just javascript It can be any other code that executes inside of your browser environment that has access to The DOM to your cookie to the URL to different bits of information like that It's able to make requests to either your site or to other sites on the internet and then potentially parse the responses and You know, this is like the sounds perhaps to a lot of folks like Ajax, right? That's exactly what Ajax does or exactly what flash-remoting is all about people to flash game on top of Drupal That's how your game is supposed to work So the idea is that you know sure you can use javascript to build rich interfaces or you can use it to attack a website Same tools with a different purpose So, you know if you're trying to test a site for cross-site scripting What I like to do is use, you know There's a couple of different ways that you can Demonstrate a cross-site scripting issue and if you try out, you know, both of these strings you will catch the majority of Issues there are sort of some less common ways of executing cross-site scripting But the idea is that you want to break out of Whatever the context is the HTML context and just have some sort of a new tag that's being displayed So variations on these will catch 90% of cross-site scripting examples according to my very scientific Throwing a finger up in the air and coming up with So how do we how do we fix cross-site scripting? A common reaction is to say well, you know We should validate inputs and make sure that the input doesn't contain javascript But you know if you look at Drupal.org for example, there's javascript everywhere That people have input because they're saying hey, how do I get this javascript to work? So you can't just remove javascript from the inputs because it might actually be the content of your site Instead the really the right way to deal with it is to filter the text on Output to the browser and you want to do that as late as possible But ideally before the theme layer is sort of the standard so that the protection is part of what the code That's always going to run That way if you switch the theme you're not going to create a vulnerability because the text has not been filtered yet And really you know again. I talked about the idea of the framework providing protections Drupal has a lot of protection for cross-site scripting built into it so the Set title function has changed from Drupal 6 and then in Drupal 7 now it automatically will filter text for you That's just one example But the tools for translation the t function that also has filtering built in to protect against cross-site scripting So here's a Here's an example if you have some text that you need to explicitly filter because you're not passing it through a function like T or or Drupal set title or whatever This is a way this is a flow chart for figuring out what you should be doing in order to properly filter that text And I think that this is is linked but the idea is you know you just start off and say okay Is this a URL if so I'm going to use check URL on it Is it plain text and it's important to think about plain text that you know if there's a Like a greater than sign inside of the plain text then check plane will turn that into the HTML entities so that it is Printed out as you know ampersand GT Semicolon is it rich text and rich text is sort of you know that that Has a special meaning within the Drupal world really that's any sort of text that has a format associated with it So a node body is an example of rich text in Drupal where there is a you know People choose a specific text format to use Associated with that piece of text and so check markup takes not just takes two arguments Not just the text itself, but also the appropriate format to use The next one is if you have you know some HTML So an example of this might be a label to display next to a field Then you could use filter XSS on that and then finally if it's truly quote-unquote trusted text Then you can just print it out directly And the idea there is that you root like you really really really have to trust that text So an example would be like if you're inputting JavaScript to be executed as part of the Google Analytics Scripts on a page. Okay. Well if you filter that for JavaScript then inputting the JavaScript isn't going to be very effective So the way to keep a site safe in that scenario is to just use a an elevated permission Associated with inputting text on to that form All right, so access bypass is second biggest and one of our fastest growing issues And this is really just people can either see something or do something on a site that their permissions Or that their access on the site should normally prevent And I think what makes this so tricky is that we enforce it in Drupal in just a ton of different places So you know starting at the very beginning of a request there's the access callback and access arguments associated with a menu item Then also sometimes sprinkled throughout various functions and you know the theme layer there might be a user access call We have the node access system that has to apply to any queries or just you know printing out a node that's been loaded There's the entity access system provided by primarily primarily by the entity API module individual field access You know if you have custom callbacks in other places, you know like you have a custom PHP function You might have to do your own checking of permissions and then again, like I said in the theme layer in templates so it's really just sort of all over the place and I don't know that there's a way to really consolidate this and make it You know harder to harder to screw up So I would say that the best solution here is really to just you know do a lot of testing whenever you modify stuff related to access and You know ideally have automated testing that will run those tests for you So when I'm looking for looking at a site and trying to identify situations for access bypass I usually do that just by sort of poking around on the site accessing URLs as an anonymous user or as a lower privileged user That I might want to try to access or that that might normally be accessed by an admin You can also look at the menu definitions inside of hook menu in a module file and Look for anything that uses for example percent node or percent user See if there's any sort of a variable that's getting loaded as part of that function and switch from you know node one to No, 20 and maybe you know if no 20 is one you shouldn't have access to either because it's unpublished or because of a node access module And just try that out and I really encourage people to use be hat Unfortunately if you're here that means that you're not seeing niches presentation on be hat But it'll be you know online later today or tomorrow and you can watch it then it's a great tool for testing stuff Like this in an automated fashion So how do we fix it? I sort of mentioned this in in how do we how do we? Or at what layer layers do we? Deal with the access system But there's you know as I said user access function for permissions node access for any sort of a content access module There's the entity access function If you're writing a query using Drupal's Drupal 7 database API Then you need to be sure to add the tag on select queries in particular And then in menu definitions make sure that the arguments that you have there are appropriate. I feel like a lot of times as developers People will just copy and paste it a menu definition And it's not quite working And so they set the access call back to true and then it starts working and you just walk away, and you're like great It works awesome But then that's going to mean that it's accessible to everyone All right, so the third kind of vulnerability that we're going to talk about today cross site request for trees this is a path that takes some sort of an action and It does not confirm the intent of the user And I feel like intent is sort of a tricky thing for a computer to figure out since that's like our emotions and you know I know that machine learning is pretty advanced, but I don't know if they can figure out people's emotions about their intent So the way that we figure out somebody's intent in a way that is reliable is using a nonce or a token that is generated That uses some information about the user some information about the site and some information about the action that's about to be performed and by combining those three things into a token and Associating that with the action as the action is requested. You can be certain that the user actually intended to do that So we'll have an example of this later on But you know, how do I how do I test for that or how do I look for that when I'm evaluating a site? One thing is looking for people who access to superglobal So dollar underscore get dollar underscore post if you see that in code It's worth inspecting a little bit further and it's possible that the person really knows what they're doing and they intended to do that But it's commonly the case that that's an indication of a mistake of a cross-site request for particularly if you're taking action After accessing those variables And then you know Drupal get token is the function that we use to protect against cross-site request for trees So if you see accessing those variables without, you know, confirming a token The other thing is looking for a verb menu So I'll look at a again the hook menu definition and see something like you know delete slash all content Right, and if you don't see a Drupal get token or associated with that then that's a concern So how do we fix it? So I mentioned the idea of a Drupal get token Drupal validate token or you can also use the form API So Drupal's form API since I think 2007 2008 has included this feature by default And so if you're building a form using the form API, then you're all set Or if you're building up your own custom callback, then you know you have to use those two functions without tokens There's some videos and more documentation on the Drupal Scout website as well So now I'm going to give some demos of cross-site scripting and access bypass Okay, so so I mentioned You know this is somebody who's logged in as an admin So they have actually the permission right to to do this kind of stuff, but all just look at that It's a score already has some JavaScript for me to just copy and paste here How's it is the font size okay, so made it back to the room. Yeah a little bit bigger. Okay So the idea is that you know if you have oh this yeah So yeah, if you know if you allow somebody to input full HTML into your site Then that means that they have the ability to input JavaScript into the site And so this is you know, this is the warning sign right and what you can see is that there's actually only one of those that Executed so I put JavaScript into two different places one of them, you know the title of the page Used the check plane function on it in order to before it output the text and therefore it's filtered And it's displaying that script as content rather than executing it as part of the HTML as part of the code So it's the second one inside of the body that That executed as JavaScript So, you know as an admin okay fine. That's fine that I can enter JavaScript It's actually maybe part of my job and part of what I need to do But if you're anonymous users or if you're untrusted users on your site can do that then that's what would be a problem So then there's another Wanted to show an access bypass scenario. There's a module called the invitations module. Does anybody use that? That's many people That's that probably makes sense because it was unsupported about three months ago for a security vulnerability in it In the oh invitations is the name of the module So what it did Is a lot, you know provided a way for you to invite people to your site and it generated a token that they could use in order to join the site but it defined a view to show that information and That view did not have any permissions associated with it So if you invited, you know hundreds of users to your site Then all of their email addresses and their special secret token were available to an anonymous user And they could just go to that URL if they could guess it and see that content So this is just like a checkbox inside of the view didn't get checked the view got exported into code And then now it's on you know people's sites So this is a very typical example of that access bypass. I feel like when we put that into an advisory I'm not so sure that it's clear to people what that means But you know exposing information that should be private inside of the site to anonymous or untrusted users Is an example of access bypass? So I'm gonna talk a bit about the improvements that we have in triple seven core so This is to remind people who are still wondering why they should upgrade their sites from to provide for six to seven that they should maybe consider doing it So Many many improvements came in with the release of triple seven. So we have a stronger password hashing and salting For all the user passwords. So if you get a database stump, you can't necessarily guess or reverse engineer the passwords which you could do in triple six There's a login flood control. So people cannot read force passwords on a given account There's a protect protected crown. So that's to avoid denial of service attacks up to triple six you could basically hammer the the crown URL and stress the servers and potentially bring your site down and We also have an update manager So it's a UI to help you keep track of your modules and find the ones that need enough to be updated that have a security release So this is how the UI looks like This in this example of use module has a security update required So it's go and upgrade from three seven to three eight There's also a nice feature that not many people know about you can get your site to email you when They are new security updates on your site. So That's all part of triple seven core update manager module Triple eight. So triple it also has new security improvements again So the major one that people are often excited about is twig. So to two advantages of twig It in theory it automatically sanitizes the strings on output. So Temers or even developers don't have to worry about it so You don't have to to worry about synthesizing your output and This is an example of code that you had to write when you were using when you're using triple seven So you did directly dealing with PHP at the template level So you could potentially forget to sanitize your strings. So here we have PHP variables PHP arrays directly coming in at a theme layer and If you're not careful, you might be outputting a raw string. That's not sanitized And that could lead to cross-site scripting in Triple eight with twig. We're not dealing with PHP anymore at the theme in the templates. We We're dealing with the twig language which first of all will only output Escaped strings and it's got it on its own Logic as well. So you still have if and else and loops and all that so Should be able to do pretty much everything you can do with PHP or at least all the things you need to do at a theme look at a theme level This is in theory. So there's an issue going on that See a tracks is working on that's what Dries Dries mentioned this morning in his keynote So it's a beta broker right now, but hopefully we'll have it in triple eight core with twig so The the other thing is You're no longer dealing with PHP in templates. So that means you can no longer have things like Escaped injections or or poorly write written PHP in your template so, you know Do advantages here in having twig so we also have a whizzy wig in core So that means what's good about this is that it streamlines the configuration So we have a mechanism that keeps in sync the whizzy wig settings and the text that are allowed in the whizzy We as well as the tags that are allowed server site In your in your filters, so we already had in triple seven the server site Restricted set of tags, but now we have we have the the whizzy wig configuration tool also keeping keeping those server-side and client-side tags in sync so the example with Triple seven or up to triple seven is Developers would often like struggle like me to set set up whizzy wig and they would end up Maybe turning on full html because that that works all the time and They would grant access to full html to potentially Authentic users or untrusted users or anonymous users and essentially give them access to to hack your site so There's also a neat little filter in triple eight that I don't think many people know about it's called restrict images to this site So it's a locate local image filter It restricts the images to The images you can include in your html can only be local images. So that means you cannot perform cross site Request for tree in on the on the other sites and I will demo this at the end if we have time and so to wrap up This session before we do questions and demos. I just wanted to mention Greg's book cracking triple There's a link in there you can just go and click on on the slides Chapter six of the definitive get a triple seven also has a chapter on security You can read about the security team and look at all triple scout is a list of articles focused on security Here is the URL to the security report and there's also a group on GDO for talking about security and So I just want to pitch in that we have Sprints on Friday. So if some of you are interested in contributing or learning About security and how to use the APIs that we have in Drupal and essentially we'll be focusing on Drupal 8 But it's it's a good way to learn what's coming up So you're welcome to join is the URL to to check it out all the details and Twitter So you can also come up to us and talk. I'll be mentoring on Friday. So I'll be helping anyone who needs help So local image look at image Okay, so I have I have set up a page here Which is which includes an image? right here and There's an image tag here with a link to a different site. So this is a D7 site And it links to the logout URL and this is actually the same sites here. So So if I go to this You're all this is the URL that I go to to when I want to log out of my site the thing is I'm working on my site right now and Just to make it here red So I'm working on my site. I'm logged in just about to new to add a new node and Someone else Has set Has set a link to this user logout URL. Yeah an image. So this is this is clearly a malicious user and I'm going to save that So now when I go and visit this node on my on my other brother brother I'm essentially going to be logged out from that site Sorry All right, so I got I got logged out of my site where I was editing content simply because Someone tricked me into visiting this page that has an image and a Sierra hidden CSRF in that image so what triple eight offers is This new setting Which is enabled by default by the way It's called Restrict images to this site So I'm gonna turn that on I'm gonna lock back in here. I'm like I'm just editing my content And now if I go here This time I have a Red image. This is basically a blocked image because this this image was not Belonging to this site and Essentially, it's protecting from CSRF now And so if I go back here, I'm still logged into the initial Initial site where I was editing my content So that's the one CSRF protection Offered with your blade was doing So we have So we have potentially some more things that we could demo But we'd also be happy to take some questions if you do have a question There's a microphone in the middle of the room which will help it to get on to the recording And we also want actually what we get people to ask questions. I forgot to mention Two things in triple eight We we have the PHP model in Drupal 7 and it's been removed removed from Drupal 8 again to make it more secure and I also want to point out the built-in CSRF tokens that we have now in The Drupal 8 routing system So if you have a route and you want to make it protected so the typical example is inhibiting a view Yes, some link We had views had several Secure advisories, you know in Drupal 7 because of that But now all you have to do is Add this option in your in your YAML file when you define your routes in Drupal 8 So this will add a token to every URL that gets generated And when you try to access this route, it will check that you have the right token at the end So this is neat and if you want to evaluate the session I know that the organizers are looking for feedback So you can go to this to the session URL and Give you feedback So now we're ready for questions Hi, thank you very much So you talked about sanitizing backups So if I if I'm making backups of my site What are some processes that I can do to make sure that I'm sanitizing those backups if I'm giving those out to developers? And maybe also if if I just want to have some backups for you know, if I need to restore from my site, thank you sure So the the idea here is that you should basically have You know a set of backups of your site that are perfect right that are exactly right and you verify that you can restore from those Very easily, but then you know like I think most people Work on their site actually on or in an ideal world, right? We work on our site in a non-production environment And so whether that's your local laptop or it's a different Different environment like you know some hosting providers provide non-production environments You don't want to be working with your live data in those non-production environments such as a laptop because you know Hey, we're all going through security at the airport and we leave our laptop in the bin and now You know you have to send a letter to the 50,000 customers of your website and be really embarrassed and You know that those are the sorts of things that are just a horrible experience to have happened, right? so There are ways to different script examples that people have created for Sanitizing your backups and this this links to an article in the aquea knowledge base about how to do that one of the techniques that I think is really great is a tool called Drush SQL Sanitize and so that is a It's an extensible system for sanitizing backups so you can write a Drush command that will sanitize information or it's just you know either deleting rows or changing data inside of rows Like changing an email to be user ID plus example calm right something like that and So by using Drush for it one of the benefits is that it can be part of the contributed module on Drupal dot org and then when somebody downloads that module they can get the benefit of that improvement so For example, there's the Facebook module FB dot module has a Drush Has a Drush component that will delete your Facebook secret token for your app because if somebody got access to that They could you know potentially modify your Facebook app and log into Facebook as stuff like that So that's one example of a contributed module that takes care of it for you But it's very important that you know You're doing that only on developer copies not on the copy that you could potentially be using for restoring the set. Oh, yes With the with Drupal Drupal 8 in the CFRF and the images not coming from the same site How does that affect use of a CDN? So that the the filter in Drupal 8 and there's actually a Drupal 7 port of it as well So the goal that it's it's Just sort of a useful tool for making sure that images come from a trusted source Basically so that people can't post images that are hosted elsewhere It has a side effect. You know CS are pretty images image tags are one way to To exploit a CSRF vulnerability, but there's many other ways to do it What really all you need to do is trick somebody into visiting that URL And so you can trick somebody into doing that by sending them a tweet with a shortened URL that ends up at that destination, right? Or send them a you know link in a variety of different ways that makes them end up on that page Use an iframe rather than an image tag So CSRF it's not an effective protection against CSRF Particularly, but it is a good tool for making sure that images come from trusted sources So specifically your question about using a CDN with that I believe that there's a patch to allow white listing additional domains so that you could have your site and potentially others But that patch has not made it in yet, and I'm not sure if that will make it into Drupal 8 But it could potentially be in You know a contributed module I didn't catch that you said the slides would be available. Where are they gonna be available? Yep, I just posted a link to them as a comment on the on the bottom of the session page So I encourage you to go to the session page and scroll down and fill in the survey and then you've got the link to the Hi, yes, so from a lot of questions, sir. Yes From your slides cross-site scripting looks like it was really popular in Drupal I was wondering you know you showed an example of an alert box But that was a very scary is what are some of the things that maybe we should be worried about with cross-site scripting? That could happen on our sites. Sure So cross-site scripting, you know the alert box is great because it makes it hard to ignore what's going on Usually when there's a cross-site scripting attack You won't know that anything has actually happened because the JavaScript just runs and it takes actions on your site But if anybody is a fan of musicals what I like about cross-site scripting is that anything you can do cross-site scripting can do better It it can make requests to your site change settings change the password Well depending upon which version change the password for another user on your site Yes, do steal your cookies and send your session cookie to another site and an attacker can use that to log in as you so Really anything that anything that you can do as an admin on the site cross-site scripting can do That's one of the reasons I really like the paranoia module because it prevents execution of PHP So that way if somebody has the ability to execute cross-site scripting the worst that they can do is whatever they can do within the interface They can't use your site as a pivot point to do further PHP attacks Yes Hey, thanks a lot guys. You mentioned using B. Hat Yeah, could you elaborate on that and give some maybe give some examples? Sure. Sure So just a you know super simple example If you have a site where people should not be allowed to see where anonymous users should not be allowed to see user profiles It would be like, you know two-line B. Hat test to say given I go to You know slash user slash one then I should not see You know some HTML that would show up on a page showing a user profile And and or you know given I'm an anonymous user when I you know go to user one whenever it is so that that's a Just one very simple example, but there's the Drupal extension for B. Hat It's a Drupal dot org slash project slash Drupal extension has some different tools that you can say given I'm logged in as a user with this role And and then you can list off a bunch of things that that person either should or should not be able to do And just confirm that they're getting you know an access denied page or a login page Or access denied page or they're getting the actual page And what I you know what I think is nice about that is that it's very easy to make mistakes with access bypass and It'll affect some totally different part of the site, but you don't even think about And so if you're not using automated testing then you're not gonna Catch all of the different areas of your site. I Think this might be my last question um So you mentioned like some modules for doing analysis on your site is you you said that there's a security review that you might demo Could you demo that one? Yeah, thank you So so the security review module is it's really a module written by a smart guy Doesn't provide a link to the reports from modules So I it's already enabled on this site and it's inside of the reports area And and the when you first visit it it'll say, you know, hey you have to You have to you know be sure to configure your settings So security review module doesn't know who is trusted or not trusted on your site by default It assumes that the anonymous user is not trusted which makes sense and it's it will Set I think the authenticated user checkbox based on your registration settings on your site and administrator the core the Drupal 7 Administrator role is assumed to be trust or yes assumed to be trusted You can also say like oh these things. I don't care about or these things and and check them off as things that should be skipped So I'm just gonna accept the defaults and then go back to the run-in review It uses the batch API because some of the things that it checks can be slow On certain environments or depending upon the size of your code base So there's a lot of weaknesses in this site Yeah on the locals at local host So this is pretty common right for a local host environment that to have a lot of issues And some of these things, you know, it's not like the end of the world a lot of them are Defense in depth issues so on their own they don't present a risk necessarily But they they may present a risk depending upon other configurations or weaknesses inside your site There are handy-dandy details about each of the issues so you can read through Understanding understand what the threat is or what the risk exposure is and then it also gives instructions for how to fix the issue Hey, um, thank you on the Restricting images to your current site. Is that a per image setting thing or is that global over the whole site? It's a peer text format setting so typically On your site, you only have a handful of them text format So typically you have like few or four maybe more, but it's you can go to configure your text format and it's It's right here in the enable features. So it's just a on and off setting where there's no other setting for it And yeah, so it's it comes by default enabled on the basic On the basic XML because this is a granted access to authenticated users And I know this users also don't have cannot post images. So by default again by default everything is secure Matter of you know keeping those settings secure and tight Changes for your config We're we're just about the end of our times So thanks very much for joining us today if you have any feedback you can leave it online or just deliver directly to us We'll be here chatting for a bit longer. Thanks very much everybody


Atoms are the building blocks of matter.  Atoms are extremely small. It cannot be seen with a naked eye or even a magnifying glass. The word atom comes from the ancient Greek word atomis which means indivisible. For example, if you take a block of gold and chop it in half, chop it in half again and again and again for a very very long time you would eventually get to a point where you can cut no more and be left with the smallest piece of gold possible and the individual gold atom. Think of the block of gold as a room of balloons. If you halve the number of balloons in the room, halve it again and again and keep doing this till you eventually end up with just one balloon and then you cut the last balloon. Does it still function as a balloon? No, the same can be said about atoms. If I were to halve the last atom of gold it would no longer be gold. Soon atom is the smallest unit of an element having all the characteristics of that element.