![\"cmssecurity\"](\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/2025\/03\/cmssecurity.jpeg\")
<\/center><\/p>\nThoughts on security in general<\/h2>\n
Saying open source is more secure or less secure than closed source is not something anyone can say with any real objective evidence. There are essentially two completely different methods of security at play here, best described as security through obscurity (closed source) and security through transparency (open source).<\/p>\n
Security through transparency<\/h2>\n
If we look at the latter first, open source platforms (WordPress, Drupal, Joomla for example) are developed by 10,000s of developers across the world. As the source code is open and visible, it means that in theory <\/i>the huge developer communities that work on these open source platforms can test new code to a far greater extent than those written in closed source environments.<\/p>\n
It also means in theory<\/i>, that more vulnerabilities will be found and fixed, as there are more developers testing the code. It also means that vulnerabilities, when discovered, can be fixed more quickly, as there is much more development resource available to make the fix. It does also mean though that vulnerabilities are highlighted to the world at large, and therefore, hackers.<\/p>\n
All of this however, works to ensure a secure\u00a0code base, especially in mature open source CMS platforms like Drupal which launched in 2001 and has now had over 10 years of open source development. Drupal are very open about the security vulnerabilities they discover and patch. You can see them all here:<\/p>\n
https:\/\/drupal.org\/security<\/a><\/p>\n On the core Drupal platform, there have been 10 security alerts over the last 3 years, and only 2 this year so far.<\/p>\n On the flip side, from a closed source perspective, this means that the code base is owned, tested and updated by a team of developers and the world has no visibility of the server side code at all. \u00a0These teams are specialist developers and in theory<\/i> know their own software well, meaning they in theory<\/i> know some of the potential vulnerabilities and put in practices to minimise security risks.<\/p>\n Partner development agencies are allowed to integrate sites, and in some cases, extend the original functionality of the platforms, but again, this code is kept closed (for the most part).<\/p>\n This in theory<\/i>, makes it less straight forward for hackers to find vulnerabilities in the first place. If you can\u2019t see the code, you can\u2019t get at the vulnerabilities\u2026 Unfortunately, it\u2019s not that straight forward. \u00a0Hackers are very<\/b> clever, and if they are so inclined, not having the source code isn’t going to stop them hacking something.<\/p>\n In my research, I’ve stumbled across various tools they have at their disposal (things like IDA pro for example) which will actually give them the ability to reverse engineer the code instead. Tools like this work across open and closed source platforms.<\/p>\n So, just because the code is closed source, it doesn’t make the software itself more secure. Let\u2019s not forget, companies like Microsoft and Adobe develop on a closed source basis, and vulnerabilities here are exploited<\/a> regularly<\/a> too.<\/p>\n A quick search reveals details of vulnerabilities in the closed source CMS\u2019s too, they just<\/a> aren\u2019t<\/a> published<\/a> on the closed source platforms public facing websites.<\/p>\n Really what I’m getting to is that software is not more secure or less secure because it is open or closed source. Secure software design, source code auditing, quality developers and design process all play into the security of a piece of software, and none of these are directly related to a project being open or closed source.<\/em><\/p>\n From a CMS perspective, no matter what solution you choose it won\u2019t be 100% secure. The most important thing is that the software is maintained well and kept up to date. Leaving the software out of date, means leaving vulnerabilities open, so combating that is the best way to stay secure. \u00a0For the most part, your closed source CMS license fees will cover updates. If you choose an open source platform you\u2019ll need someone to update the CMS (a techy, an agency, etc).<\/p>\n It\u2019s important to remember though that the CMS is just one piece to the security puzzle. The server environment is another factor.<\/p>\n In 2011, Linux servers were running around 80% of the websites in the world (including Google, Yahoo, and Facebook).<\/p>\n Again, people argue whether Windows servers (closed source) are more secure than Linux servers (Open source) which you can see more about here: http:\/\/www.cyberciti.biz\/tips\/is-linux-really-more-secure-than-windows.html<\/a><\/p>\n This article makes a similar point, as long as the server is well managed, and kept up to date, it\u2019s secure as it can be, but a server will never be completely secure.<\/p>\n I’m certain the open vs. closed source argument won\u2019t be solved anytime soon (and I doubt my non-committal post will help with the resolution). They have different models of ensuring security but neither is conclusively better than the other. As long as you choose a CMS that is tested and updated on a regular basis, then you\u2019ll be as safe as you can be.<\/p>\n From a security perspective, good security practices will have a much greater effect on security than whether you\u2019re on an open source of closed source platform.<\/p>\nSecurity through obscurity<\/h2>\n
Security through good practice<\/h2>\n
More to security than the CMS<\/h2>\n
So what\u2019s the answer?<\/h2>\n