Secure

CSRF and XSS prevention, DoS mitigation, SQL injection defense... they are all built-in to Drupal. You can read more about Drupal security.

There are occasional security updates for Drupal core, and contributed modules. It's important to apply those updates quickly. Some web hosting companies apply core updates automatically.

Drupal asks for an administration email address when it is installed. It sends update notifications to that address. Someone should be monitoring the email account.

Drupal has a security team.

Skilling uses Drupal's existing mechanisms as much as possible. For example, when students submit exercise solutions, they use Drupal's form system. The form system has built-in security checks. For instance, Drupal forms include tokens, protecting against CSRF attacks.

Some parts of Skilling use client-side Ajax code that is not a standard part of Drupal. For example, the grading interface is implemented in Vue, a framework for making rich client-side JavaScript applications. However, every Skilling Ajax transaction runs against a server controller that invokes Drupal services for token validation, tag whitelist filtering, etc.

Skilling cannot be activated unless certain security conditions are met. The most important of these is the creation of a private file system, usually a directory not accessible to the web server. All student submissions are stored in the private file system.

A private file system is optional with Drupal, but is required for Skilling.

Georgina

Wait, I don't get it. If the web server can't access student submissions, what's the point?

The web server can't access the files, but Skilling's code can. Skilling runs its own security checks on data requests. If the checks pass, Skilling reads the files itself, and passes the data on.

Georgina

Is that an extra load on the server?

You're right, it is an extra load. It's not significant for a small class. However, if there are thousands of students using a Skilling site, it's something to consider in capacity planning.

Procedures for installing and updating Skilling are explained in the project's documentation.

Skilling's approach to security is explained in documents included with every installation. Security code is centralized in a handful of classes, for easy inspection and testing. The code itself is documented thoroughly.