Changes for page What an XWiki Security Review Should Actually Include
Last modified by Agnease on 2026/06/08 18:44
Summary
-
Page properties (1 modified, 0 added, 0 removed)
Details
- Page properties
-
- Content
-
... ... @@ -45,6 +45,11 @@ 45 45 </p> 46 46 47 47 <p> 48 + An XWiki security review is a practical audit of the platform configuration, access model, 49 + authentication setup, installed extensions, custom code, infrastructure and recovery procedures. 50 + </p> 51 + 52 + <p> 48 48 Security risks are often hidden in less visible areas: outdated versions, inherited permissions, 49 49 forgotten administrator accounts, overly powerful rights, old extensions, undocumented scripts, 50 50 weak fallback access or backup assumptions that were never tested. ... ... @@ -122,7 +122,7 @@ 122 122 of small exceptions that nobody reviewed later. 123 123 </p> 124 124 125 - <p> 130 + <p> 126 126 For a deeper look at this topic, see 127 127 <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">why XWiki access rights need a clear governance model</a>. 128 128 For a practical starting point, see ... ... @@ -176,7 +176,7 @@ 176 176 A structured review can check versions, access rights, authentication, 177 177 extensions, custom code, infrastructure, backups and operational practices. 178 178 </p> 179 - <a class="btn btn- secondary" href="$xwiki.getURL('contact.WebHome')">Request a security review</a>184 + <a class="btn btn-default" href="$xwiki.getURL('contact.WebHome')">Request a security review</a> 180 180 </div> 181 181 182 182 <h2 id="security-checklist">XWiki security review checklist</h2> ... ... @@ -239,60 +239,87 @@ 239 239 permissions, extensions, customizations and recovery procedures were configured years earlier. 240 240 </p> 241 241 242 - <div class="resource-note"> 247 + <div class="resource-note related-resources"> 248 + <p><strong>Security review series:</strong></p> 249 + <ul> 250 + <li> 251 + <a href="$xwiki.getURL('resources.xwiki-security-review')">What an XWiki security review should actually include</a> 252 + </li> 253 + <li> 254 + <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">Why XWiki access rights need a clear governance model</a> 255 + </li> 256 + <li> 257 + <a href="$xwiki.getURL('resources.xwiki-access-rights-review')">How to start an XWiki access-rights review</a> 258 + </li> 259 + </ul> 243 243 <p> 244 - <strong>Security review series:</strong> 245 - this article is the main overview. You can also read 246 - <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">why XWiki access rights need a clear governance model</a>. 247 - Future topics will cover authentication and access control, script and programming rights, backup validation, 248 - extension review and operational practices. 261 + Future topics will cover authentication and access control, script and programming rights, 262 + backup validation, extension review and operational practices. 249 249 </p> 250 250 </div> 251 251 252 252 <h2 id="security-review-faq">XWiki security review FAQ</h2> 253 253 254 - <h3>What should an XWiki security review include?</h3> 255 - <p> 256 - An XWiki security review should include the installed XWiki version, upgrade path, 257 - access rights, groups, authentication setup, installed extensions, custom code, 258 - infrastructure, backups, restore expectations and operational procedures. 259 - </p> 268 + <details class="resource-faq-item" open> 269 + <summary>What should an XWiki security review include?</summary> 270 + <p> 271 + An XWiki security review should include the installed XWiki version, upgrade path, 272 + access rights, groups, authentication setup, installed extensions, custom code, 273 + infrastructure, backups, restore expectations and operational procedures. 274 + </p> 275 + </details> 260 260 261 - <h3>Is an updated XWiki instance automatically secure?</h3> 262 - <p> 263 - No. Updating XWiki is important, but security also depends on permissions, 264 - authentication, extensions, custom code, infrastructure configuration, backups 265 - and how the instance is maintained. 266 - </p> 277 + <details class="resource-faq-item"> 278 + <summary>Is an updated XWiki instance automatically secure?</summary> 279 + <p> 280 + No. Updating XWiki is important, but security also depends on permissions, 281 + authentication, extensions, custom code, infrastructure configuration, backups 282 + and how the instance is maintained. 283 + </p> 284 + </details> 267 267 268 - <h3>Does SSO solve XWiki access control?</h3> 269 - <p> 270 - No. SSO helps authenticate users, but access control still depends on XWiki groups, 271 - inherited permissions, page-level rights and administrative privileges. 272 - </p> 286 + <details class="resource-faq-item"> 287 + <summary>Does SSO solve XWiki access control?</summary> 288 + <p> 289 + No. SSO helps authenticate users, but access control still depends on XWiki groups, 290 + inherited permissions, page-level rights and administrative privileges. 291 + </p> 292 + </details> 273 273 274 - <h3>Why should custom code be reviewed?</h3> 275 - <p> 276 - Custom scripts, templates, macros, UI extensions and Java components can affect 277 - permissions, workflows, rendering, integrations and upgrade behavior. They should 278 - be identified, documented and tested. 279 - </p> 294 + <details class="resource-faq-item"> 295 + <summary>Why should custom code be reviewed?</summary> 296 + <p> 297 + Custom scripts, templates, macros, UI extensions and Java components can affect 298 + permissions, workflows, rendering, integrations and upgrade behavior. They should 299 + be identified, documented and tested. 300 + </p> 301 + </details> 280 280 281 - <h3>When should an XWiki security review be done?</h3> 282 - <p> 283 - A review is useful before a major upgrade, after years of organic growth, after 284 - authentication changes, before exposing the wiki more broadly, or when the instance 285 - becomes business-critical. 286 - </p> 287 - 288 - <div class="resource-note"> 303 + <details class="resource-faq-item"> 304 + <summary>When should an XWiki security review be done?</summary> 289 289 <p> 290 - Related resources: 291 - <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">why XWiki access rights need a clear governance model</a>, 292 - <a href="$xwiki.getURL('resources.why-upgrade-xwiki')">why regular XWiki upgrades matter</a> 293 - and 294 - <a href="$xwiki.getURL('resources.xwiki-custom-development')">how to keep XWiki custom development maintainable across upgrades</a>. 306 + A review is useful before a major upgrade, after years of organic growth, after 307 + authentication changes, before exposing the wiki more broadly, or when the instance 308 + becomes business-critical. 295 295 </p> 310 + </details> 311 + 312 + <div class="resource-note related-resources"> 313 + <p><strong>Related resources:</strong></p> 314 + <ul> 315 + <li> 316 + <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">Why XWiki access rights need a clear governance model</a> 317 + </li> 318 + <li> 319 + <a href="$xwiki.getURL('resources.xwiki-access-rights-review')">How to start an XWiki access-rights review</a> 320 + </li> 321 + <li> 322 + <a href="$xwiki.getURL('resources.why-upgrade-xwiki')">Why regular XWiki upgrades matter</a> 323 + </li> 324 + <li> 325 + <a href="$xwiki.getURL('resources.xwiki-custom-development')">How to keep XWiki custom development maintainable across upgrades</a> 326 + </li> 327 + </ul> 296 296 </div> 297 297 298 298 <div class="resource-cta">