Information Security Consulting

Information security reaches most organisations in one of two situations: either an audit or a customer contract has made it mandatory, or an incident has already happened. In both cases security gets discussed after the system is running. Security added afterwards is expensive and fragile — permissions are corrected with patches, and because protection is spread evenly everywhere, the data that actually matters gets lost in the crowd.

We write the access model and the data classification at the start. First we establish which data is genuinely sensitive. Personal data, financial records and trade secrets do not have to be protected at the same level; trying to protect everything at the highest level ends in practice with nothing being protected. Once the classification is clear, who can reach what and which fields are masked become part of the design.

From there we tie it to daily work: security criteria are added to code review, dependencies are scanned against known vulnerabilities, passwords and keys are kept outside the source code. We write compliance requirements not as clauses of regulation but as what gets recorded on which screen and how long the data is kept. The organisation decides which risks are acceptable; our job is to make sure that decision is an informed one.