One of the key advantages of a centralized platform like Drupal Cloud is that Brown’s sites share a common foundation. When a critical security update is needed, it can be applied to all sites at once, quickly and reliably, rather than site by site.

What this means for you:

• If any action is required of Drupal Cloud site editors for security reasons, we will notify you by email.
• If you do not hear from us, you may assume that the central web and digital teams in OIT and OUC, working with our cloud providers, are addressing the issue.

This guidance applies to sites on platforms centrally maintained by OUC and OIT, including Drupal Cloud, Sites.Brown, and Google Sites. If you maintain websites built by outside vendors or hosted on other platforms, a different process may apply. If you are unsure whether a website you manage is centrally maintained for security, please contact [email protected].

AI’s Impact on Website Security

We expect security updates to become more frequent and, at times, more urgent. Advances in AI are making it faster and easier to identify weaknesses in software, which means fixes will sometimes need to be applied quickly. In rare cases, if a vulnerability is serious enough, we may need to take websites temporarily offline to protect them until a fix is in place.

Last week’s PHP security issue, which received national news coverage, is a recent example of our approach working in practice. PHP is the technology on which Drupal is built. The necessary updates were applied across all Drupal Cloud sites by Brown’s cloud providers, and no action was required of web content editors.

Brown uses several vendor services, including Cloudflare, that help protect our centrally-maintained websites during events like this. These services work alongside our content management systems, such as Drupal Cloud, and the dedicated security professionals in OIT. While no safeguard can eliminate all risk, together this provides a strong layer of defense as we navigate an evolving security landscape.