Defend · Device protection
Servers
A server holds the file share, the directory or the practice software for the whole firm. It is hardened to a baseline, patched in agreed windows, watched, and tied to a backup we have restored.
One server, the whole firm’s files.
A laptop holds one person’s work. A server holds the file share, the directory everyone signs in to, or the application the practice runs on, and a ransom note on it stops the whole firm. So a server is treated differently from a laptop: it runs nothing it doesn’t need, nobody signs in to it for everyday work, admin access goes through the vault, and it is patched in a window agreed with you, never at noon on a deadline day. In your office or in Microsoft Azure, the baseline is the same, and each server is tied to a backup that has been restored on purpose, so the way back exists before you need it.
What we set
Hardened, patched on a date, watched, with a way back.
Every server is written down with what it does, who may reach it and when it may be restarted. The baseline is applied to that, on the premises and in Azure alike.
-
Hardened to the baseline
Only the roles a server needs run on it; everything else is switched off. Its firewall allows what the firm uses and nothing more, and remote access to it goes through the firm’s own sign-in, never through a port open to the internet.
-
Admin access through the vault
No one signs in to a server with an everyday account. Admin access goes through the vault: few people, by name, every use logged. The local admin accounts are documented and their passwords rotated.
-
Patch windows agreed with you
Server updates need a restart, and a restart at the wrong moment stops the firm. The patch window for each server is agreed with you, outside your working hours, and written down. Updates go to a test system first where one exists.
-
Watched for what matters
Each server is monitored: disk, backups, the roles it runs, failed sign-ins, the signs of an attack. What the monitoring finds is reviewed by our engineers, and what we change because of it goes into your evidence file.
-
Tied to a tested backup
Every server is on the backup schedule, and the backup is restored on purpose: a dated restore test stands behind each one.
-
In Azure: in your own subscription
Servers in Azure run in a subscription your firm owns, with the network, the backups and the access documented. The keys stay yours: if you ever leave us, you leave with the subscription and everything in it.
On record
On record for the servers.
- Every server with its role, its baseline and its patch level
- The agreed patch window for each server, and when it was last patched
- Who holds admin access to it, through the vault
- The backup it is on, and the date of its last restore test
- What the monitoring found, and what we changed because of it
What we find on servers we take over.
-
Patched when someone remembers
No window, no schedule: the server is restarted when a problem forces it, and the updates of two years arrive at once, on a Tuesday, with the firm working.
-
The old provider’s agent still on it
A server restored from an image taken while the previous provider’s tools were still on it carries those tools into the new environment. They have to be found and removed, with proof.
-
A backup nobody restored
The backup job reports success every night. The first restore is the one after the ransom note, and it is the first time anyone sees that it doesn’t work.
Questions we get
Our servers are in the office. Do they have to move to Azure?
No. The baseline, the patch windows and the monitoring are the same on the premises. Whether a server should move is a question for your roadmap, decided with your TechPilot, not a condition of protecting it.
When are the servers restarted?
In the window agreed with you for each server, outside your working hours, and written down. Not in the week of a submission or a filing deadline, and never without notice.
What happens if a server is hit by ransomware?
It is cut off from the network, the evidence is kept, and we find out how they got in and what left. Then the server is brought back from the tested backup, in the agreed order, the door is closed, and the whole thing goes into your evidence file. Who has to be told is your call; we give you the facts and the timeline.
Start
When was a restore of your servers last tested?
In a first call we go through your servers, what each one does, who can reach it, when it is patched, and when a backup of it was last restored.
- No first level
- No surprises
- Pilot before you buy