Everybody IS Responsible

• Many (most?) would prefer not to admit to it, but deny it or not, we are either part of the problem or solution
  • Not all equally though; passive users do not require same level of knowledge and are less complicit than developers and administrators
• Developers MUST take notice of their actions; there is no such thing as code that doesn't matter
  • A LOT to know but there is a lot of help too; one rule -- do not trust input unless you can verify it came from a trustworthy source
    
    • Always Sanitize (check_plain(), check_url())
    • Always Parameterize (db_query())
  • Use Whitelist not Blacklist (approve not reject)
  • It bares repeating -- DO NOT TRUST USER INPUT!!!
• Administrators cannot trust developers to do the right thing
  • There are simply too many people with varied knowledge, experience, and expertise
    • True for administrators as well, of course
      
  • There are simply too many nasty people; it is when not if a web site attacked (and "when" can be measured in minutes from turning on the spigot)
    
  • Not feasible or reasonable for administrators to vett all code; must vett policies and processes instead
    • That code MUST be vetted or it should not be used
  • Should stay active in all relevant security advisory forums: Bugtraq, NT Bugtraq, Drupal Security
    • It is a MUST for many sites, day-zero attacks are possible
  • MUST look at automatic update logs, reminders, etc
    • Lots of assistance in Drupal but little automation; being proactive is far more productive than reactive
  • MUST include all parts of computing stack you are responsible for
    • It is a layered approach, upper layers rely on lower layer security
    • Drupal, PHP, Web Server, Database, File System, Operating Systems, Firmware (just another OS) 
    • Similarly to code -- library and API writers have extra duty as others rely on them
      
• End Users -- Unlike most of the rest of our world, we cannot both use (shared) computing services (of any kind) and not be a part of security
  • Identity theft happens in may different ways
  • But that reality can't change parallel reality; people HATE security!!!
  • True dilemma that has no good solution for all; each site must make decision -- convenience vs security
  • Simple rules:
    
    • No stupid passwords (but most people don't understand what "stupid" means!)
    • No shared passwords, especially sharing high-security sites with low-security sites
    • No shared accounts -- from logs and legal perspective, it IS you using the account
    • No trusting code, programs, emails, applications, or even words unless you can verify the trustworthiness of source (PKI signatures help but are beyond knowledge of most)