I am working for a company with perhaps the least security possible.
We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which everyone uses for every purpose. The websites have hard coded passwords where the account information can be discovered by viewing page source.
I want to start enhancing the security here, one step at a time. However there is so much unattended to that I don't even know where to begin. What would be the basic, essential security?
I can think of
1. Using HTTPS for the websites and apps.
2. Creating numerous accounts that have different read and write privileges as opposed to everyone using the root account.
3. Then making sure each app is using the appropriate accounts.
What are the other things I should focus on?