Securing a corporate IS
Modernising a hybrid infrastructure during an apprenticeship — real work, presented in anonymised form.
Context
A long-standing on-premise corporate information system, to be evolved towards a hybrid architecture (on-premise ↔ cloud) while significantly raising the security baseline — without interrupting the business. My role: systems administrator, then Head of Information Systems on a work-study contract.
Hardening
- Active Directory: hardening GPOs (automatic lock-out, USB restrictions, enforced updates), plus permission and access audits.
- Internal PKI: centralised certificate management, TLS everywhere (Let's Encrypt on the public side, internal authority on the private side).
- VLAN segmentation to isolate sensitive traffic.
- EDR (CrowdStrike) rolled out across the whole estate.
- Recurring vulnerability assessments (OpenVAS, Nessus) with triage and remediation of critical findings.
- Secured remote access: Fortinet VPN/firewall; UFW/iptables on Linux.
Resilience & monitoring
- Proxmox cluster with virtual-machine high availability.
- Real-time monitoring: Prometheus + Grafana with Node Exporter.
- 3-2-1 backups (Burp Backup) with regular restore tests — an untested backup does not exist.
- A documented and rehearsed disaster recovery plan to guarantee service continuity.
Governance
- Centralised documentation (BookStack): procedures, architecture, runbooks.
- Bash/PowerShell automation of recurring tasks.
- Budget management, sign-off on technical choices, reporting to management.
- Training teams on security good practice.
Details are deliberately kept general: this work was carried out for an employer, and the specifics of their infrastructure are not mine to publish.