We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider this lapse to be particularly grievous, given the relatively small consequences of not having this information secure. I am primarily interested in learning from this experience.
Last week, our web developer sent an email to me and the IT staff:
I did not realize that [project1] and [project2] had been put directly inside of /var/www on [my-server], but thought they had been put outside of publicly accessible space. I have corrected permissions to prevent access to anything sensitive at the moment, but they should not be in /var/www as only the 'public' folders need to be linked there.
Because of this all the files in the [project1] and [project2] projects have been accessible to the web since the start of the projects. From this people would have had access to all files in the projects, even access to database dumps and logs that have been stored there. It would be worth while to know if anyone has ever accessed any files in the 'path/to/project1/db_backups', 'path/to/project1/config', 'path/to/project1/db', 'rails/project2/db', 'rails/project2/config' folders as stored passwords could be found in these folders.
- Was I at fault for assuming that either the IT staff or the web developer should have dealt with this?
- Who is responsible for making sure that sensitive information is properly secured?
- Are there steps beyond checking logs that I should take?