- Audit
- Hardening
- SIEM
- Monitoring
Cybersecurity and system hardening
Protect your data before the incident — and know exactly what to do during one.
Most of the compromises we see are nothing sophisticated: a reused password, a mailbox without two-factor authentication, an admin account shared between four people, a backup drive permanently plugged into the network. These are not attacks, they are doors left open.
Our approach starts there: close the obvious doors before buying anything. We audit what exists, harden configurations, put multi-factor authentication in place, and check that your backups would survive your network being encrypted.
The problems this actually solves
Five weaknesses we find at almost every audit, and what each one opens up.
The same password covers mail, banking and the server
One leak on an unrelated site opens all three. We put a realistic policy in place: a password manager, unique passwords, and multi-factor authentication where it counts.
The business mailbox has no second factor
This is the most used entry point. Once inside, the attacker reads the exchanges, waits for an invoice, changes a bank account number and sends it on. MFA makes that attack markedly harder, at no cost.
The backup drive is permanently connected
If ransomware encrypts the network, it encrypts the backup too. A backup that cannot be reached from the infected network is the only one that really counts.
Everyone works with an administrator account
Every click becomes a possible installation. We separate admin accounts from working accounts and cut privileges where they serve no purpose.
Nobody would know what to do during an incident
Who unplugs what, who calls whom, which backup to restart from. We write that procedure while all is well, because nobody writes it during.
What we build
Three stages, and they are ordered: look, close, watch.
Audit
- Security audit of machines, servers and network equipment
- Review of accounts, rights and administrative privileges
- Vulnerability and patch-level analysis
- Internet exposure check: open ports, remote access
- Review of the backup strategy and a restore test
- Written findings with a prioritised remediation plan
Hardening
- Multi-factor authentication rolled out
- Password policy and a password manager
- Privilege reduction and separation of admin accounts
- Firewall configuration and closure of unnecessary access
- Machine and server hardening, unused services disabled
- Encryption of laptops and removable media
Resilience and monitoring
- Offline or off-site backup, unreachable from the network
- Periodic, documented restore test
- Logging of access and security events
- A written incident response procedure
- Phishing awareness sessions for your teams
- Post-incident support and recovery
SIEM and security monitoring
Ivory Coast Connect helps businesses put monitoring solutions in place that centralise security logs, watch the events that matter and improve the detection of suspicious behaviour.
What this solves
The logs exist, but in fifteen different places
The firewall keeps its own, each server keeps its own, Microsoft 365 keeps its own. Reconstructing a timeline after an incident then takes hours of moving between interfaces that share neither a time format nor a vocabulary.
Nobody looks, because nobody has the time
A service restarting in a loop, an account failing twenty login attempts overnight: those signals are visible, but only if someone opens the log. An alert turns a signal into a notification.
After an incident, nobody can say since when
Without central retention, logs rotate and disappear within days. The question “how long has this been going on?” stays unanswered, and so does the real extent of the compromise.
The traceability being asked for is not sustainable by hand
A client, an insurer or an authority asks you to prove who accessed what, and when. Without central collection the answer is assembled afterwards, from whatever is left.
What we build
Collection and integration
- Centralisation of logs across the estate
- Collection of Windows events, workstations and servers
- Server logs: system, application, file shares
- Network event collection
- Integration with the firewall and network equipment
- Integration with Microsoft 365 and cloud services, as required
- Retention period defined and storage sized accordingly
Analysis and alerting
- Alert rules, tuned to limit noise
- Monitoring dashboards
- Free-text search across collected events
- Support with incident analysis
- Monitoring of suspicious activity
- Security event tracking over time
- Improved traceability and available evidence
Putting monitoring in place
Useful monitoring is built in stages: collect first, tune the alerts afterwards, and accept that it takes several weeks for the noise to settle.
Who it is for
Organisations with a server and a directory
Active Directory produces the most useful logs: logins, repeated failures, rights changes, account creation.
Organisations with a traceability requirement
A client, an insurer or an authority asks you to prove who did what, and when.
Organisations already hit by an incident
Afterwards the question is always “since when?”. Without collection it stays unanswered.
Sites with many devices
Firewall, servers, workstations, cameras, Microsoft 365: that many separate logs to bring together.
Use cases
Detection of abnormal login attempts
Twenty failures in two minutes on one account, or a successful login from a country where nobody works, at three in the morning.
Active Directory event tracking
An account created, someone added to an administrative group, a password reset outside the usual procedure.
Monitoring of critical servers
A service stopping, a disk filling up, an unplanned restart, a backup task failing for three nights.
Detection of unusual activity
A machine starting to talk to addresses it has never contacted, or transferring volumes unrelated to its usual role.
Centralisation of scattered logs
Firewall, servers, workstations and Microsoft 365 brought onto one timeline, readable from a single place.
Post-incident analysis
Reconstructing the sequence: entry point, accounts used, machines reached, data consulted, and when.
Good practice
- Start with a narrow scope: the logs that serve, not every log that exists
- Set the retention period before sizing the storage
- Few alerts at the start, then tuning against your real data
- Protect access to the SIEM itself: it concentrates sensitive information
- Check that collectors are still reporting — a silent agent does not warn you
- Document what is collected, what is retained, and for how long
- Review the rules periodically: a changing estate makes rules obsolete
A SIEM does not prevent an intrusion and does not detect one on its own. It improves visibility, detection and analysis — provided it is correctly configured and regularly maintained. Badly tuned, it produces a stream of alerts nobody reads, which is worse than no monitoring at all. Depending on your estate and your budget we deploy solutions such as Wazuh, Microsoft Sentinel, Elastic Security, Graylog or Splunk. We are not an official partner of any of these vendors.
How a project runs
Four stages, including written findings you keep even if you stop there.
The measures that count, in order
There is a clear hierarchy between what genuinely protects and what merely reassures. Here is ours, from most useful to least urgent.
- Multi-factor authentication on mail and remote access
- Offline or off-site backup, verified by a real restore
- Separation of administrative and working accounts
- Unique passwords, held in a manager rather than in memory
- Security updates applied, including on network equipment
- Closure of remote access left open on the internet without need
- Logging, so that “since when?” has an answer after an incident
We do not sell security through fear and we do not promise invulnerability. No arrangement provides it. What these measures provide is that an incident stays an incident instead of becoming a shutdown.
Who it is for
The question is not the size of the organisation but the nature of the data handled and the cost of a stoppage.
Firms and regulated professions
Client data, confidentiality obligations, liability in case of a leak.
Businesses handling payments
Invoice and bank-detail fraud is widespread and direct.
Small businesses with a server and shares
Ransomware finds everything in one place if nothing is partitioned.
Health and education
Sensitive personal data and retention obligations.
Associations and NGOs
Few resources, but beneficiary and donor data all the same.
Real use cases
Five typical requests, including those that arrive too late.
-
Your request:
“An employee clicked a link and gave away their password”
Ivory Coast Connect
Immediate reset, check for forwarding rules created in the mailbox, MFA switched on, recent access reviewed.
-
Your request:
“We received a supplier invoice with new bank details”
Ivory Coast Connect
Verification of the message origin, check for compromise, and a validation procedure outside email.
-
Your request:
“Our files are encrypted and we are being asked for a ransom”
Ivory Coast Connect
Network isolation, assessment of the extent, restore from the offline backup, analysis of the entry point.
-
Your request:
“Our client is asking for a security audit”
Ivory Coast Connect
Audit, usable written findings and a prioritised plan to present.
-
Your request:
“We simply want to know where we stand”
Ivory Coast Connect
A full audit with no commitment to remediate: you keep the document whether or not you give us the follow-up.
Why give us this work
Nothing unverifiable: no years in business, no client count, no certification. Only the way we work.
We start with what is free
MFA, account separation, closing unnecessary access. We propose a purchase only once everything that costs only time has been used.
The findings are yours
The audit document belongs to you and remains usable by another provider. We do not hold it hostage.
No promise of invulnerability
We tell you what each measure covers and what it does not. Security is managed, not bought.
Our other services
One point of contact for all of your IT.
An audit, or an incident under way?
For an incident in progress, call directly. For an audit, the survey and the quote are free.