I am working for a company with perhaps the least security possible.

We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which everyone uses for every purpose. The websites have hard coded passwords where the account information can be discovered by viewing page source.

I want to start enhancing the security here, one step at a time. However there is so much unattended to that I don't even know where to begin. What would be the basic, essential security?

I can think of
1. Using HTTPS for the websites and apps.
2. Creating numerous accounts that have different read and write privileges as opposed to everyone using the root account.
3. Then making sure each app is using the appropriate accounts.

What are the other things I should focus on?

closed as too broad by TildalWave, Xander, AJ Henderson, Mark, Eric G Nov 12 '14 at 23:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Get your company to hire a pen-tester, it's generally a really loud wake-up call when they see the report. – Paradoxis Nov 11 '14 at 9:36
  • @Paradoxis I think the company is a bit negligent about security related matters and wouldn't hire a pen tester. Do you have any suggestions for me to start on? – krikara Nov 11 '14 at 9:47
  • It never hurts just to sit down with your boss to talk about these issues, but in the end if they don't want to invest the time, you can't change that. It will come back to them once some script kiddie takes over the servers. – Paradoxis Nov 11 '14 at 10:36

From your question and comments it seems that the business leadership of your company have no interest in security. This is the fundamental thing you're going to have to fix before you do anything else. Implementing security controls is inevitably going to a) cost some money and b) cause some pain. Without support from your leadership, you won't get over these hurdles.

This means putting together a solid business case to show how ignoring these risks is going to hurt the company, and selling it to them.

Once that is done, you still have the question of where to start. As an ISO27001 nerd, I'm going to suggest you start with a thorough risk assessment. Put together a list of the assets you need to protect. For each one, identify the threats they face and the vulnerabilities they have. Estimate the likelihood of damage and the cost to the company. Those two figures let you roughly calculate a level of risk. (e.g. things that are very likely and would cause a lot of damage are high risk) That gives you a list of risks in order of how worried you should be about them, and you can just start at the top of that.

  • Absolutely. This HAS to come from the top. Security has to meet the business objectives. You cannot bolt on security because of best practices alone; you have to do what the company needs. An internal audit (like ISO27001) can help focus efforts and cover bases that might not be thought of. – schroeder Nov 12 '14 at 18:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.