During today there have been various good suggestions about what perhaps should happen afterwards going forwards - and I thought it might be useful to have them in one place...
Just to acknowledge:
- Mumsnet is a commercial operation - so ultimately their decision
- Mumsnet has no value without its users, so their opinion is v. important
- Mumsnet has a really strong role particularly for those who at times are vulnerable / needing help & support etc. - so security is very important.
Random thoughts - so add yours...
Security Audit
After this is all over, MN should bring in an established / expert external company to run a security audit
- software scan for vulnerabilities
- human scan
Penetration Testing
They should then set up a test version of the site / offline version and pay a company to regularly run penetration testing against it... if it has dummy data in it, we could all play and maybe prizes for any successful hacking :)
Software Audit
They should get a company in to run a software audit looking at old code / current code /vulnerabilities / efficiencies / etc. However good coders might be, it is easy to make mistakes - having another company as a sounding board is very helpful
Software Updates
All software updates should be externally audited before going live
All software updates should go via the test site for penetration testing and vulnerability checking before going live
Passwords
When you log in the script sees your clear text password - encrypts it and then checks against the stored password - at that point in the script there could be an analysis on how secure it is - if not secure enough, make the user change it. In theory all should be more secure with the recent change, but security needs will undoubtedly change and this is the place to do it...
Future Hacking
If this happens again, there should be a strict procedure:
- take site offline
- put up message
- use facebook to communicate with users / issues
- test offline
- fix
- back online
online protection
evaluate the need for stronger online protection - using companies like verisign to protect against DDOS etc.
any other thoughts - do add them!