Service · Information security

Improving infrastructure security

A service for those who face no regulatory requirements but would rather not be brought to a standstill by ransomware. We start with an audit and close whatever gives the greatest effect for the smallest outlay, which usually means configuration rather than purchasing.

Submit a request What is included

Audit

5 working days

No purchases

in the first instance

A plan

by priority

Verification

of the result

What is included

We look not at compliance with regulations but at real resilience against common attacks.

Discuss the scope

Perimeter audit

What is visible from the internet, which ports are open, whether any forgotten access remains.

Accounts and rights

Shared passwords, accounts of former employees, excess administrators, the password policy.

Updates

How far behind the systems are and how the patching process is organised.

Backups

Whether they exist, where they sit, whether they are protected against encryption, whether they have ever been restored.

Segmentation

Whether an infection of one machine can spread across the whole network.

Work plan

A prioritised list with an estimate of effort and cost.

How the work runs

The audit takes a week, closing the top priority items usually two to three weeks.

Data gathering

We survey the infrastructure from outside and inside and interview the administrators.

Report

Findings with a danger rating and a clear description of the consequences, rather than a list of technical terms.

Quick wins

We close whatever can be done by configuration: passwords, rights, ports, protection of the copies.

A plan for later

Whatever requires investment is set out separately with justification and an order of priority.

In a typical audit, 70 percent of the findings are closed by configuration without a single purchase. Shared accounts, a remote desktop forwarded to the internet, unprotected backups, local administrator rights for everyone: all free to fix and all giving the greatest gain in security.

Frequently asked questions

How does this differ from a data protection compliance audit?

That one checks compliance with the requirements of the law, this one checks real resilience. They overlap but do not coincide: you can be fully compliant and still fall to ransomware, and the other way round.

Will the audit disrupt our work?

No. The main part is examining configurations and interviewing people. Active scanning is done in a gentle mode, and heavy checks are agreed and carried out outside working hours.

What do we get at the end?

A report with findings sorted by danger, an estimate of the cost of remediation and a clear explanation of what will happen if they are not fixed. Plus the free items closed straight away.

Other services in this area

The whole area

We will run a security audit

Five working days and you will know where the holes are and what to close first. Most of it we close immediately, without purchases.

Phone
+7 (495) 978-63-36

Email
office@apply.ru

Office
Moscow, 108 Profsoyuznaya St.

I consent to the processing of personal data