1

first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise.

Last week I was thinking about how the market usually provides services focused on medium/big companies. On one hand, it makes sense, bigger company = more money but, on the other, it annoys me how unfair is that the smallest and modest companies are not an area of interest for the main business.

So, if you had to create a budget model for every small company, what would be the least principles to follow if we take into account the following premises:

  • Company with UP to 10 people, this means that in total there will be 10 workstations
  • This company did not buy yet any hardware as FW or SW
  • This is a simple company that
  • There is no plan on scalability/ company growing, therefore thinking of a centralised solution as an AD would probably be meaningless
  • A wifi AP would be nice, but not mandatory
  • There will be at most 1 or 2 servers exposing DB services (or something similar)
  • The people in the company should be able to access somehow the DB service when they work at home (OpenVPN)

My penetration testing mindset came with these recommendations:

  • Create an inventory of every element that has connection capabilities and which is intended to be used
  • Assess the password security policy and adapt it accordingly
  • Create a golden image or similar that will be installed on every WS computer, this image should bring effective hardening adapted to the business.
  • Assess the security of the servers installed, this includes the services exposed, avoid cleartext protocols,outdated/deprecated versions...
  • Create a VPN server that implements MFA
  • Ensure that the HDDs are encrypted
  • Educate the users

I know that is not perfect and these are the topics where I might find some confusion:

  • A security policy/ threat model has to be created. But I have no clue about how to do that. What is a good starting point?
  • Does the use of a SOC makes any sense in this context?
  • Would it be needed to hire a part-time sysadmin?
  • In terms of network topology, my idea was something like this: enter image description here

I know that it might be bad but honestly, I did not find any "golden" rule about how to create effective network diagrams. I simply adapted what I saw on the internet + experience

Finally, I would like to add that even though this looks like an enormous and wide question, it is actually not that wide. Lots of small companies have to deal with this problem which is not easy to solve. From my perspective (that has nothing to do with seceng) I have seen a lot of obscurity on this topic particularly for people with 0 security knowledge as if the industry was specifically interested in not providing clear answers.

Thanks to everyone.

Improve this question
10
  • 2
    On a security point of view, the most dangerous component lies between the chair and the keyboard, unless properly educated. And security that comes at the price of useability comes at the price of security. Those are not just empty sentences, but mean that you must first identify the business requirements, then the higher risks, and only then propose actions. One size fits all is no good for security, neither for large nor small companies. Of course a firewall is a must have, but for small companies the one given by the ISP can be enough.
    – Serge Ballesta
    Apr 1, 2021 at 15:11
  • Not just educated, but supported. Not all human factors are training-related.
    – schroeder ♦
    Apr 1, 2021 at 15:44
  • 2
    As for your specific questions, it depends entirely on a risk assessment. There is no single rule that can apply. Every business is different. For instance, why would you install servers locally? That's what the cloud is for. And once you go cloud, why have a network that looks like it was designed 20 years ago? The reason it is easier to apply big business models is because most big businesses look alike. Small businesses can look very different from each other. The consequence of that is there are no quick and easy answers.
    – schroeder ♦
    Apr 1, 2021 at 15:48
  • 3
    I don't think you have considered just how wide your question is or how many ways one could design a secure architecture within the scope of your requirements. Google Business accounts, Chromebooks for everyone, DB servers in the cloud. There you go: sorted. No need for VPN, there is central admin, no sysadmins, no images, HDD encrypted by default. Done and dusted. But you have also asked about processes and policies, and budgets. What you have asked would take a consultant a large report to answer. This is too big for a Q&A site.
    – schroeder ♦
    Apr 1, 2021 at 16:10
  • 1
    Follow my "ELITE" model: meet External compliance requirements first, then Lean security (the absolute basics), then Internal compliance (what the org wants as a baseline), then design for Targeted risks and threats, then Emerging risks and threats. You evolve security, you don't design and implement based on blind "best practices". It needs to meet the needs of the business every step of the way (and those needs change as well).
    – schroeder ♦
    Apr 1, 2021 at 16:16

0

Reset to default

Browse other questions tagged .