What are the 'todos' when your database is hacked?
I want to plan for the terrible nightmare of my database being stolen. I feel I am secure, and I am not holding much actual data, but... if it does get taken - what do we do, is there a standard way of drupalists to respond?
I am looking for specifics where obviously required, e.g. 'reset all passwords', but how?
In Drupal 7, while all passwords are hashed (SHA-2 with 64-bit words) and salted, if your user's passwords have low entropy, brute-force password attacks are feasible.
Readily available brute-force crackers check 200-500 million hashes per second on a single commodity PC, not 1000. That means a 44-bit password doesn't even last half a day, and a password as 99% of users will realistically have will last 1-2 seconds at most.
This means that if you experience a breech, you should force your users to reset their passwords, there's is the Force Password Change module that will invalidate all passwords and force users to set a new one.
There is also the Password Policy module that let you set a policy to force users to pick a password that is hard to crack by brute force (but it tends to enforce the type of policies the xkcd cartoon above lampoons, so I am not a big fan of it).
In addition to these modules, there is a recipe on Drupal.org to create a drush command to change passwords on accounts that are not actively used that may be used to invalidate passwords for stale accounts.
You may also condsider making your site less vulnerable to password cracking by adding Two-Factor-Authentication.
To guard against PHP injection, you may want to install the Paranoia module.
The Paranoia module attempts to identify all the places that a user can evaluate PHP via Drupal's web interface and then block those. It reduces the potential impact of an attacker gaining elevated permission on a Drupal site.
To monitor your site and detect unauthorized changes, you may want to install the MD5 Check module.
The MD5 Check generates a md5 checksum of all module files. If module is changed a critical security error is generated in watchdog log.
There may be other sensitive data in your database beside passwords (e.g. credit card numbers, medical records). If you're really worried about your database being stolen, you need to encrypt sensitive data stored in the database. The Encryption module helps you defend sensitive data by means of symmetric encryption.
The the Payment Card Industry PCIComplianceGuide.org AFQ provides guidelines for what you should do if your site stores sensitive data. It also links to guidelines for dealing with data breeches.
Depending upon your location, yoy may have to report a data breach to affected parties. In the EU/EEA, this is mandated by the Privacy Directive. In the US there are now over 38 states that have privacy law that mandates notification. See www.privacyrights.org for more details.
Acknowledgements: Thanks to @Damon for pointing out that even 44 bits of entropy may not be good enough these days. Thanks to author of Cracking Drupal and Security Team member @greggles for bringing the Drush command to invalidate old passwords and the Parnoia module to my attention. Thanks to @Ben for making me aware of the PCI guidelines.
What are the recommended directory permissions?
What are the potential security issues when importing an entity type?
What steps are necessary to build secure database queries from user input?
What are the possible exploits if settings.php is writable?
Will forcing validation on a node save result in security issues or data integrity loss?