Black October: what being on alert looks like

Between 19 and 22 October, a run of serious security flaws was made public, one after another. The biggest was in PHP, the software behind a large share of the world's websites, including most WordPress sites. Within hours, attackers were trying it against sites everywhere, and governments and large organisations took websites offline to fix them. In the same few days, fixes landed for other widely used web software, and a company that issues the certificates behind the padlock in your browser turned out to have keys that could be forged.

Most of these weaknesses had been sitting there for months. What changed this week is that everyone, including attackers, now knows about them. The race is between the people fixing and the people trying the locks.

None of the systems we look after run on PHP, so the headline flaw passed them by. The same week brought urgent fixes for the software they do run on.

Every system we look after, ours and our clients', got the same treatment.

1. 01We moved our live websites and apps onto the fixed versions as the fixes came out, and checked what was actually running on each server, not just what was installed.
2. 02We stopped trusting the compromised certificates on every server we look after, so a forged padlock cannot fool them.
3. 03We shut a door before a fix existed. One flaw had no fix at all yet. The part of the system it lives in was something none of them needed, so we switched it off everywhere.
4. 04We checked our own work. A scan of what was really running caught two services still waiting for the fix. Both were done the same evening. That is what the scan is for.
5. 05We made sure the next one reaches us first. We now check for new security warnings every 10 minutes and scan what is running on every server every hour. If a machine appears that we don't know about, an alert fires. A serious warning reaches a person within minutes, not an inbox nobody reads.

Fixing is only half of it. The other half is knowing, within minutes, when there is something new to fix.

You don't need to read the security news. We read it for you, day and night, and when something lands that touches your systems, it is handled, and you hear from us in plain English.

1. 01Is our site built on PHP or WordPress, and has it been updated since 21 October?
2. 02When a security fix comes out for something our site uses, who hears about it, and how quickly do they act?
3. 03Is there a list of everything our site depends on: plugins, servers, accounts?
4. 04If the site went down tonight, how long until it is back, and when did we last test the backup?
5. 05Who holds the passwords, and is two-step sign-in switched on for every one of them?