I'm new in this company but I'm the only one interested in security here.
If the bold phrase is literally true, you are already deep in trouble and may not be able to be effective in implementing your ideas. IT security is not, and should not, be the responsibility of a single individual. If the security culture of your workplace is lax, as it appears to be, then unless management decides to prioritize security, security will not be a major investment seen as adding value to the business.
As an IT auditor, my experience has been that an corporate IT security policy embraced and modeled by senior management is essential. I would recommend you first consider working with management to adopt a IT security policy first, rather than haphazardly implementing controls.
A good IT security policy should broadly set management expectations in areas such as
- Employee expectation to commit to protecting company assets and data.
- How policy will be enforced
- What consequences can be expected from violation of policy
- How company assets is to be classified per its "value" to the business
Only after you know what assets will be of most value and how management views its mission in protecting those assets will security controls be effective. After you learned management's stance on IT Security as described within a policy document, then the next step should be a risk assessment. Basically, at this stage you want to answer below questions:
- What threats / attack sources may threaten valuable assets identified?
- How likely are such attacks to happen?
- If an attack succeeded, how severe can the resulting damage be? (impact)
- What mitigating factors, if any, are in place already to reduce impact? (compensating controls)
Only after completing a risk assessment can security controls be meaningfully recommended to management to be implemented. Having said the above that the "IT security culture" at your company is missing, I see some controls that can be valuable based on limited information you gave.
One of our sites are accessible from outside but we do not manage such redirection, another company is tasked to manage the network
Given the network management is outsourced to a 3rd party, you want to verify controls around the following are in place:
- Contractual terms - SLA monitoring and right to audit are essential
- Vendor access to your network - How is access provisioning and deprovisoning governed?
- User authentication - How is the vendor authenticating the identities of those users coming from the untrusted Internet to your public web facing company application?