I'll answer some of my own questions on security measures: 1) We encrypt password using bcrypt, so in case of a database theft they are not easy to crack. We r

I'll answer some of my own questions on security measures: 1) We encrypt password using bcrypt, so in case of a database theft they are not easy to crack. We require SSL any time any authentication action is required -- cookies are sent with the secure option so over HTTPs only, and login/password must be entered over SSL. When you create an account your email gets a link that you have to follow and only there enter your password, same if you forget your password. No user will have an email sent nor can he even ask support what his password is. Of course this requires he can securely access his email account without anyone else snooping. 1b) We leave password strength up to customers and very few (1%) of them care to enable settings above basics (e.g. requiring password change every X days or password consisting of both numbers and digits and special characters). So while the feature is there technically, it's a failure socially. 1c) CSRF is handled by generating a token when generating a sensitive form; that token must be used when submitting that form. XSS is prevented by quoting of untrusted user input when displaying it. 2) Our SSH ports are wide open, but brute password cracking from a single IP is prevented by fail2ban which blocks IPs that repeatedly try to enter bad usernames/passwords. This does not protect against distributed password cracking which is why I like two-factor authentication. Many employees from roaming IPs access our SSH port so we can't easily firewall them, but I have a solution in mind where users can enable IP access via the web app (which uses different usernames/passwords). 3) Backups are encrypted, but that's it. If you collect fact X that may be sensitive, how do you protect that fact on disk if you have a rich web UI that uses that fact X for various reports? 5) We use mod_audit with some cut down rules and a few additional custom rules; an external company runs a Nessus-like scan. I've installed various toolkits to check vital binary integrity (rkhunter), have automatic updates from a good vendor (Red Hat Enterprise Linux). 6) I have started getting nightmares around about thepiratebay.org hosting a giant mycompany-complete-data-hahahahaha.set torrent, thus this posting :-)