IT security for companies · Hamburg Securing access, devices, network and backups.
IT security for small and medium-sized companies in Hamburg: from risk analysis through endpoint and network protection to backup, incident plan and security awareness. The security concept fits your company and also takes account of what cyber insurers, clients and regulatory frameworks require.
What I find with new clients
With new clients I usually find a classic antivirus without detection and response (EDR), a network without segmentation, and firewalls or switches whose firmware has not been updated for years. Backups exist, often offline too, but rarely immutable, and a restore has almost never been tested.
Passwords are kept in Excel lists or in the browser, SPF, DKIM and DMARC are incomplete, and hardly anyone has a written incident plan. Many are not aware how serious the situation is. A large part of my work is therefore raising awareness, before cyber insurers, clients or frameworks such as NIS2 ask about it.
What a security concept should achieve
The aim is an environment that makes attacks harder and is prepared for an incident: secured identities and devices, segmented networks with firewall and VPN, protected email and dependable backups. Alongside that, clear responsibilities and an incident plan for the case where protective measures are not enough. What that looks like in Microsoft 365 is shown by a security concept for an engineering firm.
Building blocks for a secure company.
-
Risk analysis and security concept
Vulnerability analysis, a review of network, permissions and configurations, and a prioritised action plan as the basis for budget and sequence. For Microsoft 365 I use an automated tenant audit and check again after implementation whether the measures are working.
-
Identity and access protection
Multi-factor authentication, Conditional Access, permissions only as far as needed (least privilege), protection for privileged accounts and a password manager.
-
Endpoint protection and MDR
Endpoint protection with detection and response (EDR/XDR) and device encryption. From around 100 staff I also recommend managed detection and response with an analyst team around the clock.
-
Network security
Next-generation firewall, segmentation into security zones, secure VPN and zero-trust principles for access from outside.
-
Email security
Protection against phishing, spam and malware, SPF, DKIM and DMARC, encryption and archiving.
-
Vulnerability and patch management
Regular, controlled updates for operating systems, applications and firmware, with monitoring of open vulnerabilities.
-
Backup and disaster recovery
Backup following the 3-2-1 rule including Microsoft 365, optionally with a copy on my servers in German data centres, separate from your network. Plus restore tests, which I recommend quarterly, and defined recovery times.
-
Security awareness
Training and phishing simulations so staff recognise attacks and react correctly.
-
Incident plan and response
Who does what when something happens: contacts, locking accounts, recovery, communication and reporting obligations.
Microsoft 365 under review.
I check your Microsoft 365 tenant against recognised frameworks and show where action is needed. The first check is free, with a short assessment as a PDF.
Get the free check→- Checks
- ~500 Checks
- Areas
- 12 Areas
- Frameworks
- 5 Frameworks
My order of work
If there is budget for only one measure, I recommend MFA for every login, on-premises and in the cloud. Backup, endpoint protection, network and awareness training with phishing simulations follow. I introduce a password manager that suits the company, for example Proton Pass, NordPass, RoboForm or 1Password.
For endpoint protection I am not tied to any vendor. Where Business Premium is in place, I usually recommend Microsoft Defender for Business, because it works closely with Intune and Conditional Access. Where another product fits the concept better or the client wants it, I use that, including with MDR. Where the licence does not include Defender for Office 365, I usually add Hornetsecurity for email protection.
From practice
A client with around 60 staff was hit by a ransomware attack with a ransom demand. The attackers had encrypted all company data on the computers and network shares. Because backup and recovery had been planned properly beforehand, the company was working again within 48 hours.
My clients include operators of critical infrastructure. I support certification to ISO 27001 or TISAX. Penetration tests and forensics are handled by specialist partners I bring into the project.
Security solutions I use.
Which components make sense depends on risk, environment and how much protection is needed.
- Endpoint protection by concept
- Sophos, WatchGuard or Bitdefender where they fit the concept better or are requested, optionally with MDR: an analyst team assesses incidents around the clock and steps in.
- Sophos Firewall
- Next-generation firewall with segmentation, VPN and Synchronized Security with endpoint protection.
- Microsoft Defender & Conditional Access
- Protection for identities, devices and email within Microsoft 365, with access rules by user, device and risk.
- Hornetsecurity
- Email security, backup for Microsoft 365 and security awareness training with phishing simulations.
- Bitdefender
- Endpoint protection as an alternative, depending on the environment and requirements.
- AvePoint
- Backup and governance for Microsoft 365, SharePoint and Teams.
- Proxmox Backup Server
- Backup of virtual servers with verification and targeted restore.
How a security concept comes together.
-
01
Analysis
Risk analysis and inventory: what is there, what is active, what is missing?
-
02
Prioritise
An action plan ordered by risk and effort, matched to your budget and to what insurers or clients require.
-
03
Build
A gradual rollout, agreed with your staff, so security works in everyday use.
-
04
Operate
Monitoring, updates, reporting and regular review, because both threats and your environment keep changing.
Questions about IT security.
Your question isn't here? Write to me directly.
Requirements vary, but multi-factor authentication, verified offline backups, endpoint protection with detection, patch management and an incident plan are generally expected. I document the current state and close the gaps.
Directly, NIS2 mainly affects larger companies in certain sectors. Indirectly it affects many suppliers, because affected clients ask for evidence about the security of their supply chain. I help assess where you stand and produce that evidence.
MFA is the most important first step, but modern phishing techniques get around simple methods. Conditional Access, devices managed with Intune, email protection and awareness belong with it, so the measures work together.
Not every one. MDR makes sense when nobody in the company can assess security alerts promptly and an outage would be expensive. From around 100 staff I usually recommend it; below that, I assess it with you based on data and risk. Without an MDR service, you should at least have ongoing monitoring with alerting.
Want to talk through a specific project?
Send me a couple of lines about it, or just call. You reach me directly, no call centre.