This aricle falls foul of what I might call &#x27;security shopping&#x27;-- passing mentions of lots of brightly coloured complex sounding security things with very little regard to what exact problem they&#x27;re solving.<p>They mention a VPN or insecure access panel having bad permissions, but recommend a mixed bag of differently coloured jellybeans as the solution without once reccomending shutting down the PHP script, allowing access from the VPN only through certificate, password and hardware two-factor authentication, and ensuring good access controls and employee on- and off boarding systems.<p>Far more importantly, I question the efficacy of any security recommendation that doesn&#x27;t mention threat modelling at all. What is it you want to protect? What&#x27;s it going to cost to protect these things? What&#x27;s it going to cost to lose them? What&#x27;s the simplest and most effective best way of protecting these? Is it really moving your entire system to a different platform and upgrading all your cypto -- ask yourself -- are we really installing air bags, or are we building our car out of armour plates? Some kid is going to spend 2 hours on XSS in your app if you spend all your resources investing in in-datacentre encryption and service-to-service authentication.