System hardening and vulnerability remediation in Corsica
System hardening means reducing the ways into your IT. You remove what is not needed, fix the flaws, apply safer settings. From Bastia, we secure your machines and your network, along with the applications and data that run on them, then check that every fix holds without getting in the way of your business.
Hardening and remediation, two steps to securing your IT
Hardening starts from a simple idea. Every service switched on, every account left open, every piece of software installed is a possible door. Hardening a system means closing the doors you do not need, locking the ones that must stay open, and applying stricter settings than the defaults it shipped with.
Remediation, for its part, fixes vulnerabilities already identified by an audit, a penetration test or a security alert. Depending on the case, that means applying an update, changing a configuration or reviewing access rights. When no patch exists yet, a temporary safeguard is put in place.
The two go together. Remediation deals with known flaws, and hardening reduces the chances of new ones appearing.
When to start vulnerability remediation
- 01
After an audit or penetration test
You have a report and a list of flaws. What remains is to fix them in the right order, then check that they are closed.
- 02
When installing a new system
A new server, network or website is far easier to secure before it goes live.
- 03
When a published flaw affects you
A vulnerability is announced in software you use. You need to check whether you are exposed, and act quickly.
- 04
After an incident
Once operations are back up, hardening the affected systems makes a repeat less likely.
What system hardening actually covers
- 01
Accounts and access
Two-factor authentication, strong passwords kept in a password manager, removal of accounts nobody uses any more. Admin rights stay reserved for those who need them.
- 02
Updates
Operating systems and software, website plugins, network kit, all brought up to date, with a method so nothing gets forgotten again.
- 03
Network
A better-tuned firewall and secure remote access. Guest Wi-Fi is kept separate from the internal network.
- 04
Servers and websites
Unused services switched off, encrypted connections, protected admin interfaces. We follow the OWASP and ANSSI recommendations.
- 05
Email
Settings that make it harder to spoof your domain in fake emails.
- 06
Data and backups
Sensitive data is encrypted. Backups are isolated from the network, and restoring them is actually tested.
Securing your IT, priorities by sector
- 01
Shops and trades
Email and the till come first, along with backups, to avoid business grinding to a halt and to head off payment fraud.
- 02
Hospitality and tourism
A strict separation between guest Wi-Fi and management tools. And a secure booking site.
- 03
Practices and healthcare
Encrypted workstations and files, named accounts, a record of who consulted what.
- 04
Startups
Cloud infrastructure and developer access. Also the protection of secrets, such as service access keys.
- 05
Public bodies
Staff accounts, shared workstations, public portals. With particular care for continuity of service.
How a hardening engagement unfolds
Every intervention is carried out with your written consent, on systems you are responsible for, and according to a plan we have agreed together.
- 01
Understand
We start from your audit or test report. If you do not have one, from a quick review.
- 02
Prioritise
Each fix is ranked by risk and effort, and by its impact on your business. The most urgent go first.
- 03
Plan
Each change is prepared with a backup beforehand and a rollback plan, then scheduled in an agreed time window.
- 04
Apply and verify
We apply the changes, then check that everything still works and that the flaw is properly closed.
- 05
Document
Every setting is written down, so that you or your provider can maintain it.
What you get, and the follow-up afterwards
- 01
A change log
What was changed and when, and for what reason. And how to roll it back if needed.
- 02
Configuration documentation
The settings chosen for your systems, reusable for any new equipment.
- 03
Vulnerability status
For each vulnerability in the original report, its status. Fixed, mitigated, or accepted with full knowledge of the risk.
- 04
Simple guidelines
A few practical rules for your team, such as using two-factor authentication or the right reflex when a message looks suspicious.
- 05
Follow-up
After the engagement, we can keep track of updates and run periodic reviews. Or train your team so they can take over.
Points to watch, and what drives the cost of remediation
Badly prepared hardening can block a piece of business software, or stop a colleague from working. So we test every change, and a rollback is always planned. On the budget side, the quote depends mainly on the following.
- 01
Number of vulnerabilities and systems
The number of workstations and servers involved, not forgetting websites and other devices.
- 02
Age of your equipment
Systems that no longer receive updates call for workarounds, or even replacement.
- 03
Business constraints
Work outside opening hours or out of season, a test environment to set up.
- 04
Business software
Whether it copes with stricter settings, sometimes to be checked with its publisher.
- 05
Level of follow-up
A one-off intervention, or regular support over time.
Technologies and methods
- System hardening
- Patch management
- Two-factor authentication
- Firewall and segmentation
- Backups
- ANSSI recommendations
Frequently asked questions
Can you fix vulnerabilities found by another provider?
Yes. We start from their report and verify each finding, then fix things according to the priorities agreed with you. A final retest confirms that the flaws are properly closed.
Will hardening make life harder for our staff?
A little, at first, that cannot be avoided. Two-factor authentication, for example, adds a step. We always aim for a level of security that stays workable day to day, and we support your team through the transition.
What if a piece of software can no longer be updated?
We isolate it as far as possible from the rest of the network and from the internet, and we restrict its access. After that, we help you plan its replacement.
Do you work on site?
Yes, in Corsica, when the job calls for it. Many settings can also be changed remotely, through temporary access that you open and close yourself.
Once hardened, are our systems protected for good?
No. New flaws turn up all the time, and your tools change. A hardened system needs upkeep, with updates kept on top of and regular reviews.