Separate CiviCRM for security?

Here's a question that came up on a client call yesterday (paraphrased for simplicity):

CiviCRM is part of our main WordPress site. Some of our board have asked whether that might present security concerns. For example if someone were to hack into our main site, wouldn't that give them access to all of our constituent information? Would it be better to run CiviCRM on a separate site, to reduce the chance of that happening?

I'm always glad to hear clients thinking carefully about security. So let's unpack this a little bit.

The short answer is: It probably doesn't matter.

The way I've paraphrased this question, there's not much security benefit to be had.

It's rather like saying: I'm concerned that if someone broke into my house they might steal my jewelry; would my jewelry be safer if I bought the house next door and kept it there?

The thing you're trying to protect has to live somewhere. And that place has to be accessible somehow.

A separate website, like a separate house, works exactly the same as your primary one. So it has all the same vulnerabilities.

On top of that, managing two properties is significantly less convenient, and more expensive (in time and money) than managing just one.

• You need two sets of keys (or passwords).

• You need to monitor both properties (or websites).

• Both properties (or websites) need routine maintenance and upgrades.

• Your own belongings (or constituent data) are now harder for you to access and use.

• Anyone who can break into your primary house (or website) can just as easily break into the other one.

• Moving valuables between one house (or website) and the other can present additional opportunities for thieves.

Here's the thing:

Merely storing your valuables in a second property, will only increase your workload, decrease convenience, add no real security value, and potentially increase the risk of theft.

Naturally, there are cases where having two separate sites could be an important component of a larger security plan.

More about that tomorrow..

All the best,
A.