Why Is Drupal The Optimal CMS For Government Websites?

 Industry-leading Security Features Keep Government Data Secure In The Face Of Increasingly Hostile Cybercrime.

Increased online data storage by government entities has made government websites increasingly popular targets for hacking, ransomware, and other cyber-attacks [1]. In the federal sector alone, there was an excess of 30,000 cybersecurity incidents in FY 2016 and more than 35,000 cyber-attacks in FY 2017 [2, 1]. These attacks resulted in millions of dollars of direct monetary losses, compromised secure data about several million government workers, and caused billions of dollars in related repair costs for damaged systems [3, 4, 5]. As high-value cybercrime targets, government entities have unique cybersecurity needs. Using Drupal CMS presents the greatest opportunities for securing web-based data against cyber-attacks, as Drupal has the most significant standard security mechanisms.

The Greatest Cyber Security Risks To Government Entities

Government websites are frequent, high-value targets of large-scale cybercrime and cybersecurity attacks. They are among the top three cybercrime targets which together account for 95% of cyber-attacks [6]. While U.S. government entities bear the brunt of cyber-attack attempts, government agencies are popular cybercrime targets around the globe [7].

In 2018 alone, there were 100 US federal government and military cybersecurity data breaches [1]. These breaches compromised 81,505,426 secure records [8]. Among state- and local-level government entities, cybersecurity measures and protocols are no less important. Small municipalities are just as likely to experience an attack as state and federal agencies [9]. Alarmingly, one-third of local governments do not currently monitor for or track the frequency of cyber attacks against their websites, and of those that do, 60% report daily (and even hourly) attacks [10]. What's more, some state and local government sites are still unencrypted and hosted through insecure connections [11]. Recent cybercrime trends targeting small and local-level government agencies have relied heavily on ransomware, a kind of malware that is used predominantly by criminal actors (as opposed to hacktivists) [12]. This kind of deliberate information technology disruption presents immense risks both in terms of likelihood and potential impact [12]. Small government entities make for uniquely damaging targets, as they manage sensitive information and critical infrastructure. Consequently, ransomware-caused outages “could have national security implications, damage the local economy, and harm the general public more broadly” [12].

Government agencies should use Drupal CMS to harden their security protections against the most prevalent types of cyber-attacks, including malware (like ransomware), hacking, credential compromise, and DDoS attacks [13]. The standard and optional security mechanisms available for Drupal users provide industry-leading protections against each of these kinds of attacks, with Drupal-based websites experiencing the lowest amounts of data breaches of the top CMS platforms [14].

Drupal’s Security Mechanisms

Drupal’s standard security and data storage practices provide enhanced protections for webmasters and site users. This empowers webmasters to implement a streamlined, single-party security solution.

Using multiple security providers/products complicates the security infrastructure in a way that increases system vulnerabilities. As a result, organizations that hope to supplement their CMS platform’s weak security provisions by using various third-party security providers nearly double their security risk [15]. Compared with other popular CMS platforms like WordPress and Joomla, Drupal offers greater built-in security for both private and government users. This diminishes the need for users to implement additional security products/services.

Drupal Increases Government Users’ Security Against Malware

Twig Auto-Escaping Prevents XSS Worm Infection: Drupal CMS relies on Twig, its template engine, to auto-escape all code inclusions. This prevents the execution of the most frequently found cross-site scripting (XSS) code injections used to target custom site themes and custom and contributed modules. What’s more, the use of a filtered HTML format for content entry in Drupal “prevents the execution of XSS attacks on other site users” [14].

Robust, Security Advisory Covered Modules: Numerous contributed modules can also harden a site’s security against other forms of malware, including adware, viruses, ransomware, spyware, and others. Many security modules are covered by Drupal’s Security Advisory, meaning that the module has been thoroughly vetted for malicious or vulnerable code and is subject to patches and fixes from Drupal’s security team [16].

Automated Error Reporting And Easy-To-Access Update/Patch System: Individual sites generate error reports when they encounter abnormal activity, which developers can access and fix via Drupal’s “watchdog” function [17]. Additionally, the Drupal security team has a well-earned reputation for excellence, with 30 formal members from organizations around the world supported by a small army of volunteers. These volunteers participate in a paid “bug bounty” program finding vulnerabilities and errors in Drupal core and module code [18]. When an error or vulnerability arises, the Drupal Security Advisory program and webmaster dashboard facilitate seamless, easy patch integration.

Drupal Increases Government Users’ Security Against Hacking

Exceptionally Audited Source Code: Drupal core is rigorously tested and highly secured. In addition to being the most-audited source code in the CMS world, Drupal core is maintained separately from modules (which are also rigorously tested). Moreover, Drupal websites are customizable without interfering with the core, enabling widespread, rapid adoption of patches, fixes, and updates.

Encrypted, Unalterable PHP Files: The on-site storage PHP files have several standard security measures in place. These include: a special file name for dumped code comprised of a hash from a secret, plus real-time assurance that file modification time is not longer than the directory modification time [19]. Consequently, though default storage permissions let anyone write the compiled files when opened, any added hash immediately becomes invalid. Should someone try to delete the file and create another with the same name, it would be similarly invalid [19].

Code String Sanitizing: The frontend and backend code on Drupal sites is continually sanitized by Twig, Drupal’s PHP template engine. Twig auto-escapes all code strings and automatically prevents potentially unsafe functions from executing. Additionally, Twig leverages Drupal’s Translation API to build secure, translatable strings from database content for frontend use and avoid the creation of unsanitized outputs [20].

Drupal Increases Government Users’ Security Against Credential Compromise & DDoS Attacks

Robust Permissions Management: Using Drupal, webmasters can create various categorical restrictions to the site access and permitted actions of different user classes. This is especially helpful for government websites, where employees may have different security clearance levels. Moreover, it is critical to ensure that non-employee site visitors have limited, tightly controlled access to information on such sites, as is easily facilitated by Drupal’s anonymous user category.

Brute-Force Attack Protections: Stored user passwords remain in hashed form. This is the result of a rigorous encryption process using Salt and Multiplicative Hash functions. Consequently, there is no available access to plain word passwords, which heightens site security against brute-force attacks. Also aiding its account protection and brute-force attack prevention is an industry-leading Flood Control system that locks down login attempts based on suspicious IP address and username activity [14]. Specifically, more than 50 login attempts from a single IP address or more than 5 login attempts from a single combined IP address and username result in login access denial. Given that recent brute-force attacks frequently involve 10,000-30,000 malicious requests submitted in under 10 minutes, this system quickly catches and stops attacks when they are less than 0.5% complete [21].

Drupal Offers Security Solutions For Government Users’ Unique CyberSecurity Needs

As a result of these security mechanisms and modules, Drupal sites experience fewer infections and breaches than any other widely-used or open-source CMS platform. Moreover, its track record working with government agencies that require the secure storage of large amounts of data and the ability to handle large amounts of site traffic is impressive. Drupal is the trusted CMS for multiple sites managed by 159 international governments, including local- and state-level government agencies in 40 countries, as well as 43 global and regional governmental organizations [22]. Drupal users include NASA, the United Nations, NATO, and at least one governmental agency in 36 U.S. states or territories [23]. Given this information, the question at hand is not whether or why government agencies should use Drupal CMS for their websites. Instead, the question is: why doesn’t the government entity you represent already use it?

References:

1. https://www.statista.com/topics/3387/us-government-and-cyber-crime/

2. https://www.heritage.org/cybersecurity/report/federal-cyber-breaches-2017

3. https://www.statista.com/statistics/474928/average-annual-costs-caused-by-cyber-crime-worldwide/

4. https://www.vice.com/en_us/article/qkjkxv/fbi-flash-alert-hacking-group-has-had-access-to-us-govt-files-for-years

5. https://www.fbi.gov/investigate/cyber

6. https://www.techrepublic.com/article/forrester-what-can-we-learn-from-a-disastrous-year-of-hacks-and-breaches/

7. https://www.cfr.org/report/increasing-international-cooperation-cybersecurity-and-adapting-cyber-norms

8. https://news.clearancejobs.com/2019/07/26/top-government-data-breaches/

9. https://www.govtech.com/computing/With-Hourly-Cyberattacks-Is-Your-Local-Government-Safe.html

10. https://icma.org/sites/default/files/19-053%20Survey%20Research%20Snapshots_Cybersecurity_web.pdf

11. https://www.govtech.com/security/More-Government-Websites-Encrypt-as-Google-Chrome-Warns-Users-Non-HTTPS-Sites-are-Not-Secure.html?AMP

12. https://www.forbes.com/sites/chloedemrovsky/2019/08/27/why-ransomware-attacks-on-local-government-matter/#636ad0605de0

13. https://www.techrepublic.com/article/the-6-most-popular-cyberattack-methods-hackers-use-to-attack-your-business/

14. https://opensenselabs.com/blog/articles/best-security-drupal-8

15. https://www.cisco.com/c/en/us/products/security/security-reports.html#~stickynav=2

16. https://www.drupal.org/drupal-security-team/security-advisory-process-and-permissions-policy

17. https://www.zyxware.com/articles/2460/drupal-debugging-tips-how-to-use-watchdog

18. https://www.drupal.org/blog/drupal-security-bug-bounty-program-2019

19. https://www.drupal.org/docs/8/security/security-of-generated-php-files

20. https://www.drupal.org/docs/8/security/drupal-8-sanitizing-output

21. https://www.foregenix.com/blog/stronger-and-frequent-brute-force-attacks-are-now-the-norm

22. https://groups.drupal.org/government-sites

23. https://groups.drupal.org/node/24119#USA