Security Checklist/Site Administration - Revision history

Wilsonge: Tool link no longer exists - it's a single article blog

2020-04-08T22:40:56Z

Tool link no longer exists - it's a single article blog

← Older revision		Revision as of 22:40, 8 April 2020
Line 32:		Line 32:

	===Proactively seek SQL injections vulnerabilities===		===Proactively seek SQL injections vulnerabilities===
	: Use tools ~~such as [http://www.parosproxy.org/ Paros Proxy]~~ for conducting automated SQL Injection tests against your PHP applications.		: Use tools for conducting automated SQL Injection tests against your PHP applications.
	<ul>		<ul>
	<li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>		<li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>

Wilsonge: Fix VEL Link

2020-04-08T22:39:55Z

Fix VEL Link

← Older revision		Revision as of 22:39, 8 April 2020
Line 24:		Line 24:
	===Stay current with security patches and upgrades===		===Stay current with security patches and upgrades===
	: Apply vendor-released security patches ASAP.		: Apply vendor-released security patches ASAP.
	* Review the [~~http~~://~~docs~~.joomla.org/~~Vulnerable_Extensions_List~~ vulnerable extensions]		* Review the [https://vel.joomla.org/ vulnerable extensions]

	===Proactively seek site vulnerabilities===		===Proactively seek site vulnerabilities===

Wilsonge: Dead link to UK CSC

2020-04-08T22:36:36Z

Dead link to UK CSC

← Older revision		Revision as of 22:36, 8 April 2020
Line 7:		Line 7:

	===Follow a password leveling scheme===		===Follow a password leveling scheme===
	: Most users may not need more than three levels of passwords and webmasters no more than five. Each level must be completely unrelated to the others in terms of which usernames and passwords are used. ~~Learn how to do this~~: [~~[How do you setup a powerful password scheme?]~~]		: Most users may not need more than three levels of passwords and webmasters no more than five. Each level must be completely unrelated to the others in terms of which usernames and passwords are used. We'll let the UK Government Cyber Security Center give the best and latest advice: [https://www.ncsc.gov.uk/blog-post/three-random-words-or-thinkrandom-0 Click here]

	===Maintain a strong site backup process===		===Maintain a strong site backup process===

M-b-o: Marked this version for translation

2020-04-04T20:44:01Z

Marked this version for translation

← Older revision		Revision as of 20:44, 4 April 2020
Line 1:		Line 1:
	<noinclude><languages /></noinclude>		<noinclude><languages /></noinclude>
	{{:Security Checklist/TOC/<translate>en</translate>}}		{{:Security Checklist/TOC/<translate><!--T:1--> en</translate>}}
	== Site Administration ==		== Site Administration ==

M-b-o at 20:43, 4 April 2020

2020-04-04T20:43:54Z

← Older revision		Revision as of 20:43, 4 April 2020
Line 1:		Line 1:
	{{:Security Checklist/TOC}}		<noinclude><languages /></noinclude>
			{{:Security Checklist/TOC/<translate>en</translate>}}
	== Site Administration ==		== Site Administration ==

Tom Hutchison: Protected "Security Checklist/Site Administration": temporary until JSST group is created ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

2015-05-14T20:01:00Z

Protected "Security Checklist/Site Administration": temporary until JSST group is created ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

← Older revision	Revision as of 20:01, 14 May 2015
(No difference)

Tom Hutchison: Reverted edits by Jzlcdh (talk) to last revision by Tom Hutchison

2015-05-14T12:44:23Z

Reverted edits by Jzlcdh (talk) to last revision by Tom Hutchison

← Older revision		Revision as of 12:44, 14 May 2015
Line 5:		Line 5:
	: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].		: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].

	===~~Consider using 2 factor authentication~~===		===Follow a password leveling scheme===
	: ~~For superusers (~~and ~~perhaps other powerful users) consider using 2 factor authentication~~. ~~{{JVer/multi\|3.2}}~~		: Most users may not need more than three levels of passwords and webmasters no more than five. Each level must be completely unrelated to the others in terms of which usernames and passwords are used. Learn how to do this: [[How do you setup a powerful password scheme?]]

	~~If you set all superusers on your live site~~ to ~~use 2FA then currently (written Aug 2014) if you are locked out~~ of ~~your site after recovery you can rename the folder plugins/twofactorauth to twofactorauth.BAK~~ and ~~log in to your site's back-end. Then disable all plugins under the "twofactorauth" group. Finally, rename the plugins/twofactorauth~~.~~BAK folder of your site back~~ to ~~twofactorauth.~~

	===Maintain a strong site backup process===		===Maintain a strong site backup process===

Jzlcdh: /* Consider using 2 factor authentication */

2014-08-26T12:20:49Z

Consider using 2 factor authentication

← Older revision		Revision as of 12:20, 26 August 2014
Line 8:		Line 8:
	: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi\|3.2}}		: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi\|3.2}}

	If you set all superusers on your live site to use 2FA then currently (written Aug 2014) you ~~will need~~ to ~~read~~		If you set all superusers on your live site to use 2FA then currently (written Aug 2014) if you are locked out of your site after recovery you can rename the folder plugins/twofactorauth to twofactorauth.BAK and log in to your site's back-end. Then disable all plugins under the "twofactorauth" group. Finally, rename the plugins/twofactorauth.BAK folder of your site back to twofactorauth.
	~~http://github~~.~~com/joomla/joomla~~-~~cms~~/~~issues/4126#issuecomment-52558665~~
	~~when doing~~ your ~~disaster recovery test~~.

	===Maintain a strong site backup process===		===Maintain a strong site backup process===

Jzlcdh: /* Consider using 2 factor authentication */ added link re secret key issue

2014-08-19T06:48:59Z

Consider using 2 factor authentication: added link re secret key issue

← Older revision		Revision as of 06:48, 19 August 2014
Line 7:		Line 7:
	===Consider using 2 factor authentication===		===Consider using 2 factor authentication===
	: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi\|3.2}}		: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi\|3.2}}

			If you set all superusers on your live site to use 2FA then currently (written Aug 2014) you will need to read
			http://github.com/joomla/joomla-cms/issues/4126#issuecomment-52558665
			when doing your disaster recovery test.

	===Maintain a strong site backup process===		===Maintain a strong site backup process===

Jzlcdh: added 2 factor auth

2014-03-17T09:16:43Z

added 2 factor auth

← Older revision		Revision as of 09:16, 17 March 2014
Line 5:		Line 5:
	: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].		: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].

	===~~Follow a password leveling scheme~~===		===Consider using 2 factor authentication===
	: ~~Most~~ users ~~may not need more than three levels of passwords and webmasters no more than five~~. ~~Each level must be completely unrelated to the others in terms of which usernames and passwords are used~~. ~~Learn how to do this: [[How do you setup a powerful password scheme?]]~~		: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi\|3.2}}

	===Maintain a strong site backup process===		===Maintain a strong site backup process===