Cyber Security

Most of the security incidents we are called in to clean up were not clever attacks. They were an unpatched server, a shared administrator password, an expired certificate that someone worked around, or a backup that had been failing quietly for months. The fix is rarely a new product — it is doing a short list of ordinary things properly and repeatedly.

Where we start

• Find out what you actually run. Servers, applications, domains, certificates and third-party services. You cannot protect an asset nobody remembered.
• Fix identity first. Individual accounts instead of shared logins, single sign-on where possible, multi-factor authentication for anything administrative, and access removed the day someone leaves.
• Patch on a schedule. A monthly window that is actually kept beats an emergency patch after an incident.
• Close the network edge. Databases and management ports should never be reachable from the internet, and internal networks should be segmented.
• Automate certificates. Expired TLS certificates cause outages and train users to click through browser warnings.
• Test the restore, not the backup. A backup job that reports success proves nothing until you have restored from it.

Then keep watching

Once the basics are in place, logging and alerting are what turn a silent compromise into a phone call. We set up log collection, alert on the handful of events that genuinely matter, and write down who is called and what they do — before it is needed rather than during.

If you would like a review of where your systems stand today, write to connect@aswathcyber.com.