Network and infrastructure security

Look closer and the picture is usually less tidy. Firewall rules that were added for a project finished two years ago and never removed. An account belonging to a contractor who stopped working with you last spring. A database that is technically internal but reachable from every machine on the network, including the one in reception. A management console protected by a password three people share.

None of this is negligence. It is what happens when access is granted quickly under pressure and nobody is responsible for taking it away afterwards. Adding a permission takes ten seconds and solves an immediate problem. Removing one takes an afternoon of checking who might depend on it, and solves a problem nobody is complaining about yet.

Applying it is where the difficulty is, because you have to know what people actually use, and the honest answer is usually that nobody knows. So we start by measuring rather than assuming. Which accounts have logged in this year. Which firewall rules have passed traffic. Which service accounts are still called by something.

That data changes the conversation. Instead of arguing about whether the finance team should have access to a shared drive, you can see that no one from finance has opened it since 2023. Most of a cleanup turns out to be uncontroversial once it is based on evidence.

The part that stays contentious is administrators, and rightly so. Removing standing admin rights is disruptive if it is done without a way to grant them temporarily when they are genuinely needed. We put that path in place first.

In a flat network, the answer is everywhere. One machine can scan the whole address range, find the file server, the backup target and the accounting system, and reach all of them. This is the mechanism behind most ransomware events that take an entire company offline. The initial infection is ordinary. The spread is what does the damage.

Splitting the environment into zones changes that arithmetic. Production separated from testing and development. Servers separated from workstations. Backups on a path that a compromised workstation cannot write to. The attacker still gets in, but arrives somewhere small.

There is a real cost to this. Segmentation makes some things less convenient, and it takes work to define which flows are allowed. We aim for the level that matches your actual risk rather than the maximum possible, because a design nobody can operate gets bypassed within a month.

We treat them accordingly. Multi-factor authentication that is genuinely enforced rather than optional. Named accounts instead of a shared login, so the audit log means something. Roles narrowed from the default, which is almost always broader than anyone needs. Alerts on the events that should never happen unnoticed, like a new administrator being created or MFA being disabled on an existing one.

Domain and DNS access deserves specific attention. It is frequently the least protected account a company holds and it controls where all your traffic goes.

The countermeasure is a schedule, not another tool. A periodic review of who has what, with the list produced automatically so it takes an hour rather than a week. Offboarding that includes systems, not just the laptop. And alerting on the handful of changes that should always be deliberate. That is enough to keep the environment close to the state we left it in, which is the actual goal.