Guide to Security in Higher Ed and Beyond
summary
Universities are high-value targets because of bandwidth, dot‑edu reputation and troves of PII; concrete defenses recommended include daily automated backups (demo restore succeeds), an offsite backup flow using Terminus + CircleCI script, automated update pipelines that spin up a multi‑dev, run visual regression and Behat, and deploy if tests pass, plus deny code writes on live, strict file permissions, routine dorkbot/drupescan audits, account lockouts and password managers — one audit found 13,000 leaked passwords with four still in use.
AI-written summary · about
chapters (22)
- 0:00Start
- 2:00Asset
- 2:13Threat
- 2:36Vulnerability
- 2:56What is "Risk"?
- 4:40Why Education is an Attractive Target
- 8:10Backups
- 15:04Keep Drupal Up-to-date
- 19:03Keep Themes/Modules Up-to-date
- 28:04Principle of Least Privilege
- 28:26File/Directory Permissions
- 32:44Remove Unused Themes/Modules/Users
- 34:29Do Your Homework on Theme/Module Selection
- 38:39Limit User Roleson Theme/Module
- 42:41Protect settings.php
- 43:44Implement SSL
- 45:35Strong Passwords
- 50:28Limit Login Attempts
- 51:27Two/Multi-Factor Authentication
- 51:52Protect/Limit Access to Login/Admin Areas
- 54:19Summary
- 55:23Questions
related talks
52mContinuous Security
48mSecurity from zero
19mThe toplist of securing your developer workstation
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
57mSomething Something Security
27mLayered Security