Nuorten Lääkärien Yhdistys
Starting point
NLY is an association of young doctors in Finland. Their website had succumbed to Drupalgeddon due to lax maintenance and late updates. There were no signs of hacking, but good practice dictated that the web service needed a thorough check up. Additionally it was deemed necessary to make sure that a similar situation would not occur again.
What did we do?
We performed a comprehensive information security audit to NLY's website ensuring that no hackers had had a chance to muck around with the site. We reviewed the general software development and security policies and established that the back up system was not up to current standards. As a part of the project, Druid's maintenance team took responsibility of the site's administration.
Results
The findings of the audit were compiled into a comprehensive report which was then given to the client. A separate list was made detailing areas of improvement, which was then used by the maintenance team to fix the site. The co-operation has continued after the audit as active small scale development and maintenance.
Even though the main reason for the audit was to reveal potential hacks, it was carried out as a more extensive whole that took into account other things, including:
● Version control policies and code retention
● Back-ups
● The update demands of Drupal and its modules
● The website settings, the displaying of error messages and the compilation of logfiles
● Passive users and user rights
● The quality of customized modules and themes
In addition to the analysis portion of the end report, we compiled a list of areas that needed updating divided by priority.
Following that we moved the web service under Druid's administration. In addition to the basic maintenance, a monthly allotment of service time was agreed upon, that would be used to add functionality to the site to service new members, and to make small scale fixes.
During the fall and winter, in addition to bug fixes, numerous features were implemented on the site, including an electronic costs reimbursement form, a databank for the member's area and a candidate gallery for the union election. Development is still ongoing.
