IT review with credentials

Why the outside view is not enough

A scan from outside sees what the server hands out: encryption, headers, cookies, mandatory legal information. That is examinable and it matters. But the faults that actually hurt a business sit inside — and no scanner looks there.

This is therefore not a test against your system but a review inside it: with credentials, read-only, without a single change.

What is reviewed

• Currency: versions of the CMS, extensions, libraries and runtime. Who updates, at what interval, and what has been stuck for years?
• Backup: Is there one? How often, kept how long, stored where, encrypted? And the question it usually fails on: has it ever been restored? A backup never restored is not a backup.
• Accounts: Who has access — including former staff, previous agencies, shared logins with nobody's name on them? Is there two-factor authentication?
• Permissions: Is every editor an administrator? Does the application run as a database user allowed to do everything?
• Logging: Is it recorded who signs in and what changes — and does anyone look? Without logs a break-in goes unnoticed.
• Email: SPF, DKIM and DMARC. Missing or set to no effect, anyone can write in your name.
• DNS: CAA, DNSSEC, dangling records — and who actually has access to the registrar.
• Separation: Do test and production run on the same machine? Is real customer data sitting in the development system?
• Responsibility: Who administers the server? That is the most common finding of all — and the one that explains every other.

What does not happen

This is not a penetration test. There is no form input, no injection of strings, no login attempts, no path enumeration, no fuzzing, no load testing and no exploitation of a weakness found. Nothing is changed.

That is not a shortcoming but the reason the review runs without a maintenance window, without risk to operations and without clearing it with your host. Anyone who needs a penetration test needs a different service under a different contract — and we say so instead of selling it alongside.

How we work

• Our own named credentials, which you revoke afterwards — no shared passwords.
• Confidentiality in writing. Where personal data of your customers may become visible, a data processing agreement is added.
• Read-only. Where something ought to change, it goes in the report — it is changed only if you commission that separately.

What you receive

• A report ordered by impact, with a concrete remedy per item — written for management and for engineering, at two levels of detail.
• A list of immediate measures: what should happen this week.
• An ownership overview: which system sits with whom, which credentials exist and which should be revoked.
• A walk-through of the report.

Effort

Billed by time and materials. For an ordinary site with one CMS, one domain and one host:

• Credentials, coordination, preparation — 1 to 2 hours
• Inventory: versions, extensions, accounts, permissions — 2 to 4 hours
• Backup and restorability — 1 to 2 hours
• Logging, email authentication, DNS — 2 to 3 hours
• Separation of environments, ownership — 1 to 2 hours
• Report and walk-through — 3 to 4 hours
• 10 to 17 hours in total.

On request: each further domain, each further host, a dedicated server instead of shared hosting, more than one CMS — and above all areas behind a login and customer portals. There the effort cannot be estimated without looking inside, and a figure would be a guess.

You receive a binding quotation once the scope is settled. All amounts net, plus 19 % VAT.