In November 2014, not long after I interviewed with ATTW leadership for the web editor position, the ATTW server was compromised. Attackers used a well-known exploit to deface the server’s page. They added a bunch of bogus posts to the forums, too (though most weren’t publicly visible). Recently, an ATTW member suggested this security breach was caused by ATTW’s use of social media. This is simply false. I know of no security research which suggests social media is a vector for server exploits. So social media coordinator Michael Faris will continue to work closely to get important information about ATTW’s work to all of our members via email, social media, and the web.
Fortunately, since the ATTW server doesn’t handle credit card transactions and/or store sensitive data, the November breach caused no long-term damage we know of. Still, it is embarrassing. As a result, I’ve made security a key priority since I began work as ATTW web editor in February 2015. Here are some of the things we’re doing to keep our server secure and our members’ data safe.
- Keeping web software up to date. This was the root of our November problem. We’ve set up notifications so I get multiple messages any time serious security vulnerabilities are published. If you see tweets from me like the one above, odds are we’ve learned of a security problem that needs immediate attention.
- Keeping sensitive data off the server. Data that isn’t on a server can’t be compromised. ATTW has always used external services to handle credit cards and financial data, and that will continue.
- Disabling software we don’t need. The modular nature of software like Drupal allows for functionality to be added as needed, which is great. But when that functionality is no longer used … why keep it around? That applies to external services, too: e.g. we have not been using ATTW’s LinkedIn account very much, so we deactivated it.
- Using two-factor authentication for key accounts. Like you, ATTW uses accounts on Gmail and other services. Whenever possible, these accounts use two factor authentication, meaning logins require a verification code in addition to a password.
- Using strong passwords which are differentiated across services. I was surprised to see the same passwords were used for a lot of ATTW.org services in the past, meaning a compromise could quickly escalate. No longer. We now use unique passwords which are long and made from diverse character sets.
We’ve planned other measures, such as use of a secure web server. And as we move forward and consider migrating ATTW web services to another platform, security will figure prominently not only in selection but configuration. Assistant web editor Michelle McMullin and I welcome your comments or suggestions about this important work.