Hi InPrint
The problem with most open source systems is that it is used by people trying to save money and not installed correctly as they don't know what they are doing.
We fix sites which have been hacked, and EVERY one that we have fixed is because of either one or both of 2 reasons.
- The files/directories were left on 777 permissions (Read and write for all)
- The system or an extension was out of date and known issues were in there but not fixed by updating it to the latest version.
Last week i was commissioned to update a Joomla site from an old version, i asked what version is it, he said ohh im not too sure, its ok, i just want the new features in Joomla 1.7.
It turned out to be Joomla 1.0.8 (2005 version), which is dozens or hundreds of upgrades out of date. He also didn't know what 777 meant, or what permissions the files/directories were meant to be set to. If he was hacked, he would blame Joomla, not his ignorance to the technical factors of running a site.
He couldn't find the database login details, so i "hacked" his site to get it, it took me 30 seconds or so to hack it and get a full backup of the SQL script.
The latest version is incredibly strong, in-fact far stronger than most commercial CMS systems. This is because there is a community of millions of people notifying forums and the bug squad of issues, which then dozens of people work very quickly on to fix them and release a new version. Over years of development and the evolution of different versions, Joomla is now an extremely secure, robust set of scripts.
Also the latest version of Joomla has a self upgrade option, which allows even the most incompetent person to click "Upgrade" and keep the site unto date. There are also other free systems made by companies such as Akeeba and
www.joomlasitemonitor.com, which checks the site for issues such as directories with wrong permissions or out of date extensions, to keep your site bang unto date.
OpenSource systems are not what they used to be, they are incredibly strong and well made by people with PhDs and have massive commercial and academic experience. Hackers can download and see the source code, so can spend hours and days trying to hack it on their own server and once they find a way, they then use that against live sites, this in turn has widdled out all the security flaws, like a set of testers, and allowed the system to become stronger. On the other hand, hackers can't see commercial CMS systems code, so are fumbling around, but once they get in, they can see it all. So in general the commercial CMS is far less secure than the open source, but once a hacker has gained access to the commercial system, they can run riot in there, as nothing is ring fenced or secured correctly to stop them.
Surely you can't believe a system made by hundreds of programmers can be less secure than a team of lets say 7 programmers making one system?
But your right for your concerns regarding security on the finance component, as it was made for my company originally and then we thought why not make it for everybody as there is a REAL need for it. This is why we spent over 12 months planning the security of the system.
The data stored for the finance component is scrambled/encrypted, and there is also 2 options within it. One is to store the data in the websites database, and the other is to store it offsite on its sister site
www.joomlasitemonitor.com. So if it their site is hacked, there is no data stored there, but as the data is encrypted and also only assigned to the clients site via a token, which has no info about what site it is referring to, then even if Joomla Site Monitor is hacked, the hacker will have no usable info.
The suppliers/customers/users are stored separately to the finance data in a separate component, so if a hacker does ever get access to the system, they will just get the value of the transaction and date it happened, but won't know who it is from, so will be useless.
The other option you could do, is set it up on a local computer, which then gives them as much space as your computer has and is lightning fast as it has no internet connection to worry about, and of course is as secure as your computer is... but still free and will work on any operating system such as Mac, Windows or Linux, so your are not limited. You could even set it up on a local server so people in the company has access to it only
