CMS Matrix -- Security and Support

Here's Part II of my series on stats from CMS Matrix.  Earlier I looked at the total number of features for the top ten most-compared CMSs.  Today I'll share the numbers on the first two categories broken out by CMS Matrix:  security and support. 

From the security numbers it's easily seen that Plone and TYPO3 top the list at 100% with eZ Publish in third some distance behind.  WebGUI hangs on in 4th and everyone else lags significantly.  In at least one way this doesn't mirror the numbers from the National Vulnerability Database:  TYPO3 shows 273 vulnerabilities in the past 3 years compared to Plone with only 7.  Having a lot of security-related features doesn't mean you have air-tight security for the system itself. 

The support statistics show a cluster of six CMSs at the top.  The top three (Drupal, TYPO3, eZ Publish) are separated from the second three (Joomla, WebGUI, Plone) by their certification programs.  The remaining four CMSs are below 80% in number of support features. 

Next up, ease of use and performance.  Stay tuned.

CMS Security

I'm still trying to catch up on blog posts after March with jury duty and emptying out the parent's home of 40 years.  For World Plone Day 2010 I thought I'd bring up one of my favorite contentious subjects:  security.  Seems like every year some pundit runs through the security arguments for CMS.  Here's my chance to get ahead of the curve.

First, the methodology.  Candidate CMS's are the top ten listed in CMS Matrix when sorted by compares (BTW, Plone comes in sixth).  The source for my security data is the National CVE and CCE Vulnerability Database, searching each candidate CMS for vulnerabilities listed in the past 3 years and past 3 months.  The highest level of vulnerability in the past 3 months were counted and totaled as a "Seriousness" score.  Here they are in alphabetical order. 

CMS	3 yr. vuln.	3 mo. vuln.	Seriousness
DotNetNuke	13	0	0
Drupal	266	16	6 medium
Joomla	426	87	36 high
Mambo	85	0	0
PHP Nuke	6	0	0
Plone	8	0	0
TYPO3	224	44	26 high
WebGUI	9	0	0
WordPress	141	6	4 high
Xoops	65	3	1 high

Second, the results.  I'm pleasantly surprised that 5 out of 10 turned up with no vulnerabilities in the past 3 months. However, of those only PHP Nuke has a better 3-year number of vulnerabilities.  TYPO3 and Joomla have a much larger number of vulnerabilities rated "high" by the National Vulnerability Database than all the rest combined. 

Typically one hears defenses like "CMS x has more vulnerabilities reported because it is more popular/has a larger install base and therefore has more eyes looking for problems."  That's the same argument Microsoft put forward for all its security flaws when compared with Linux.  You don't want to go there. 

But even putting aside the logical fallacies in such arguments, both pro and con, it's clear that systems with more security flaws require more effort to patch and lock down.  The bottom line is that more flaws mean more chances for the sys admin to slip up and more opportunities for the bad guys. 

By way of an anecdote, at my day-job our computer security people were much relieved to learn that we were using a non-PHP-based CMS.  On that note, Happy World Plone Day 2010.