Everyone is an administrator
The cashier account can delete products, because the permissions were never set. One mistake by one person reaches the whole database.
Services
Information security
The first attempt is rarely sophisticated. It is a shared password on a sticker, an administrator account nobody removed when the accountant left, or a database reachable from the internet on the default port. Security work on a small business is mostly closing doors that were left open by accident, in the order an attacker would try them.
Who it is for
- Businesses where one password is shared by the whole team.
- Companies that have never restored a backup and cannot say whether it works.
- Anyone asked by a client, a bank or a tender to describe their security.
Problems it solves
The password is in the repository
A key committed two years ago is still in the history, and rotating it means finding every place that uses it.
The backup has never been opened
A copy runs every night into a folder on the same disk. It survives a deleted table and not a dead machine.
Use cases
Roles and access permissions
Each person gets the minimum their job needs, a leaver is deactivated the same day, and the list of who can do what fits on one page.
Secrets outside the code
Keys in environment variables or a secret store, removed from the repository history, and rotated by a procedure that is written down.
A backup that gets restored on a schedule
A nightly copy to a second location, and a restore into a test environment once a quarter, with the date and the result recorded.
Patching and an inventory
What runs where, which versions, and a monthly pass over the components that have a published fix. Unpatched software is the most common way in.
What is in scope
Fixed scope. Fixed price.
Agreed in writing before anything is built. You approve before we start.
- An access review: who has an account, what it reaches, whether it should exist
- Roles and permissions per function, with a leaver procedure
- Secrets moved out of code, and the repository history cleaned
- A backup schedule, an off-site copy, and a tested restore
- Patching and library updates on a fixed cycle
- A one-page incident card: the first hour, and who to call
How it is delivered
- 01
Look at what an attacker sees
Start with the account the team actually uses, the ports open to the internet and the public repository. The person who runs the system shows us the shortcuts they were forced to take.
- 02
Close the doors before the locks
Shared admin accounts and exposed databases first; encryption choices and policy documents later. A written policy on an open door is decoration.
- 03
Prove the backup
A restore into a clean environment, timed, with the gaps written down. Until that happens the backup is a hope.
- 04
Leave a routine, not a project
A monthly checklist and a named owner. Security that depends on a consultant's memory decays within a quarter.
FAQ
Questions about this service.
What owners usually ask before requesting a quote for it.
Do you hold a security certification?
No. We hold no certifications and we will not sell you a badge. We can prepare the technical evidence an auditor asks for — access lists, backup records, the patching log — and work alongside whoever performs the audit.
What would an attacker try first?
Reused passwords against an exposed login page, then an outdated component with a published fix, then a database port left open. All three are common in small businesses and all three are cheap to close.
How often should a backup be restored?
Once a quarter is a sensible default for a business system: often enough to catch a broken script, rare enough to actually happen. The value is in the restore that was timed and recorded, not in the schedule on paper.
What is out of scope?
We are not a security operations centre and we do not watch your network around the clock. Phishing, a stolen laptop and a staff member who emails a spreadsheet to the wrong address are training and policy problems; we can write the procedure and run the session, but the daily discipline is yours.
Start a project
Want this scoped for your business?
Send the brief. It comes back as a written scope and a fixed quote before anything is built.