Typical project · Quebec and Ontario
Putting a company network back in order after a security incident
These are typical projects, described from the kind of work we do. They do not describe a named client or a specific building.
Someone from outside got into the camera recorder, and nobody can say what else was within reach. This is how the network is reviewed, then rebuilt in the right order, without stopping the business.
The situation: an intrusion, one network for everything and no trace of who connects
The client is a company with its offices and a workshop in the same building. One morning the camera recorder shows settings nobody changed and a user nobody created. The firm that installed the cameras, years ago, had opened a port on the router so that the owner could watch from home, and the recorder still had the password it was delivered with.
Nothing else seems to be missing, but nobody can be certain. The computers, the accounting server, the printers, the cameras, the door controllers, the phones, the machines of the workshop and the visitors' Wi-Fi are all on the same network, behind a router supplied by the internet provider. There is no diagram and no list of what is connected.
What the review of the network finds
- Doors open to the internetSeveral ports are forwarded to devices inside: the recorder, a door controller and the remote desktop of an office computer. Each one is an entrance that robots probe from outside every day.
- One flat networkAny device can reach any other. A visitor on the Wi-Fi is on the same network as the accounting server, and a compromised camera sees everything.
- Equipment nobody updatesThe recorder, several cameras and the Wi-Fi access points run the software they were delivered with, and people who no longer work for the company still know the administrator password.
- No trace of what happenedThe router keeps no log. It is impossible to say when the intrusion began or what was reached from the recorder. A forensic investigation of the computers is a separate mandate, given to a specialised firm.
What is designed, and why
The order matters: close what is open, separate what should not communicate, then watch what remains.
- A firewall in place of the open portsA business firewall replaces the provider's router at the edge of the network. Every port forward is closed, and the firewall inspects the traffic that is allowed.
- Separate networks by roleThe office computers and the server, the cameras and the recorder, the door controllers, the phones, the workshop machines and the visitors each have their own network. The rules between them allow only what is needed: the security desk sees the cameras, a camera sees nothing else.
- Remote access through one secured doorThe owner, the managers and the outside suppliers reach what they need through an encrypted connection, with an account in their own name and a second factor. A supplier's access is limited to its own equipment.
- Devices cleaned before they are trusted againThe recorder is reset and updated, every camera and every controller receives a new password and current software, and the unknown accounts are deleted. Equipment that can no longer be updated goes on a replacement list.
- Detection and a logIntrusion detection and prevention are switched on at the firewall, and the logs are kept for a period agreed with the client.
How the work is sequenced without stopping the business
The most exposed doors are closed first. The rest is done in steps, each of which can be undone.
- Containment
The port forwards are closed and the passwords of the recorder are changed without waiting. The owner loses the view from home for a few days, and is told so.
- Inventory and diagram
Every connected device is identified, by walking the building as much as by scanning the network, and the network is drawn as it is.
- The firewall beside the old router
The firewall is prepared in advance and put in place at a quiet moment chosen with the client, the old router staying ready for a step back.
- Networks separated one group at a time
The visitors are moved first, then the cameras, the doors, the phones and the workshop, each move being checked with the people who use the equipment.
- Remote access and review
The accounts are issued, each supplier's access is tried with that supplier, and the logs of the first weeks are reviewed with the client.
What is handed over
- The written report of the review: what was open, what was found and what was done
- The network diagram and the list of connected devices
- The firewall rules, explained in plain words, network by network
- The list of remote access accounts, by person and by supplier
- The list of equipment to replace because it can no longer be updated
- The administrator access and the passwords, handed to the people the client names
Services involved
Industry
Other typical projects
- Entry panel and fobs in an occupied rental building
- Cameras, alarm and a radio link on a construction site
- Low-voltage package of a new mixed-use building
- Wi-Fi and dock cameras in a warehouse that never closes
- A cut fibre backbone repaired and re-certified
- Leak detection with shut-off by riser in a condo building
- An office move on a fixed date: cabling, Wi-Fi, doors and phones
- Mobile coverage for two levels of underground parking
- Analogue cameras replaced by IP cameras across a group of stores
- Access control for an office building with several tenants
- Licence plate recognition at the gate of a logistics yard
- Audio and video for the meeting rooms of an office
- An old alarm system replaced in a store with offices and a stockroom
A project like this starts with a review of what is connected
Tell us what happened, what is on the network and who reaches it from outside. We review the router, the Wi-Fi and the connected equipment, then send a report that separates what is urgent from what can wait, with a quote. We reply in English or French.