4

I am using Joomla as an internal portal for a large company (an intranet).

My question is,

Is it necessary to upgrade Joomla even though it is on a private server on a internal company network?

Because every works good right now with all of my installed extensions, I don't want to fix what is not broken.

What are the risks of not upgrading Joomla on a internal network, intranet?

I am running Joomla 3.3.6

Any feedback is really welcomed.

Thanks everyone!

|improve this question
  • 2
    Remember that it's not just security fixes, but bug fixes and features that are added in patches. Compromised computers could be an issue as mentioned by Neil, so to sum it it, yes, I would strongly suggest updating. Unless you've made core code changes, the update should be fine and not break anything – Lodder Jul 11 '16 at 11:37
4

Good question!

The answer probably depends on what sort of information is stored on the intranet and whether the employees and contractors who have access to the intranet are competent and can be trusted.

Is it possible that an employee or contractor could connect a compromised laptop to the internal network where malware on the laptop could compromise the intranet?

How secure is the internal network? For example, do employees and contractors have remote access via a VPN or similar? Is temporary VPN access for contractors religiously revoked when their access is no longer required?

I'd be inclined to back up the website and apply Joomla and third party extension updates on a regular basis, in the same way as if the website were on the Internet.

The effort required is minimal and the risk of complications when applying Joomla and third party updates is low (especially if you are using well supported third party extensions from trusted developers).

In the unlikely event that an update breaks the website, it is fairly easy to restore a Joomla website from a recent backup using Akeeba Kickstart or similar.

|improve this answer
  • Can malware on a laptop compromise the website even if the laptop does not have backend/admin/editor access? But the way it is setup, there are only a few editors that are allowed to edit through the frontend, no the entire company and no one has backend access except for one admin. And I do backup using Akeeba regularly. Thanks for your feedback! – mrbuckmccoy Jul 11 '16 at 23:55
  • Malware tends to target known vulnerabilities so it's certainly possible. – Neil Robertson Jul 12 '16 at 0:06
  • 1
    Okay thanks, I definitely should treat it like a public site. I really appreciate it. – mrbuckmccoy Jul 12 '16 at 4:28
2

Unless you are blocking Internet access to all users of the intranet, you have to apply security updates.

The most common attack vectors can be used to attack your internal site:

  • Both a fishing attack or XSS vulnerability on any third party site could be used to run standardised SQL injection attacks on all sites open in the same browser, different tab.

  • the same vectors can be used to inject JavaScript via XSS b not your Intranet, then becoming a new attack vector.

    • again the same vectors can be used to impersonate your super admin on your Intranet, doing anything they want.

How do they know you have a vulnerable Joomla site? They don't, they just attack all commonly used systems.

All Joomla sites I manage are under constant attack for WordPress, Drupal, Joomla and Zend framework attacks, at least these are the ones i recognise.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.