lynis

* Project name: Lynis (https://github.com/CISOfy/lynis/), GPLv3 * Project description: security auditing tool for Linux, macOS, and UNIX-derivatives. The primary goal is to assist in security assessments and help with system hardening. Written in shell script and project is mature (almost 9 years). * Upcoming goals: More application specific tests (like MongoDB, Redis, Tomcat, nginx), so we can provide more value as a project. * Needed skills: application knowledge and able to write some basic shell script. * Contributors link: https://github.com/CISOfy/lynis/blob/master/CONTRIBUTIONS.md * Your license(s): GPLv3

At our company (CISOfy) we created a solution around our existing open source project Lynis (https://github.com/CISOfy/lynis). This way the tool in itself provides value, yet the separate Enterprise offering as well. Lynis itself is useful for a single system, yet companies might be attracted by Enterprise features (like collecting all data centrally, dashboards, reports, compliance reporting). A similar way might work for your web application, by making two different products, each with their own audience. My tip as founder: start testing the viability of your product/business first. Consider the reasons why people would or would not pay. Ask people in your field who might use it and if they would be willing to pay (and how much).

Thanks for sharing your intrusion story. Although it is always painful for the person to experience, it gives good insights on what happens in the wild. As the author of security tools rkhunter and Lynis, it is still a sign that basic (and advanced) system hardening remains needed for a long time. The other comments show that there are so many things you could do. But some are more relevant than others. That is something we want to test for in Lynis with upcoming updates. One focus area will be detecting Drupal/Joomla/WordPress installations. If anyone wants to help out the open source project and make the web a safer place, this is your chance to help: https://github.com/CISOfy/lynis Thanks again for sharing!

Step 1: Try to get in contact with the person and see if he/she is willing to help you share details on entering your systems. Thank this person and see if you can provide a reward. Step 2: Next step is setting up new systems, and start from scratch. Install the systems, start with basic system hardening and up-to-date software packages. Use https://github.com/CISOfy/lynis to validate your configuration. Do not have any interaction or data exchange with the old (compromised) systems. Step 3: Save all running systems to learn from the event. See if you can find the main cause why this happened. Step 4: Learn about security, hire someone on your team with security knowledge. Step 5: Do regular (technical) audits.