Five Stages Of Security: Build Protection Into Your System From Day One
A system can be beautifully built and still leave a business exposed if security is treated as something to add later. For me, security has to be considered while the system is being built.
When you put a system into a business, it is not about switching a switch and believing everything is done. You need to understand how the business works, who will use the system, what information it holds and what could go wrong.
I have learnt this through building systems over the last four years. At first, I was focused on building. Then I realised I had not pencilled in enough security. That changes how I think about the work. Security is not a final coat of paint. It belongs in the design, the build, the launch and the way the system is looked after.
Know What You Are Protecting Before You Build
Security starts with the business: its people, information, devices, networks and the work that must keep running.
Look At The Business Under The Hood
Before you design a system, you need to understand how work is done. That means looking at the process, speaking to the people who use it and finding where the bottlenecks are. With AI-Human Growth Systems™, our approach is to meet the people, understand the work and look for the points where a better system could help.
But you also need to ask what the system will hold and what it will connect to. Will it contain customer details, payment information, passwords or commercially sensitive data? Which people need to see each part? What happens if the system is unavailable? Those answers help you understand what needs protecting before you start building.
A cyber threat is the possibility of a malicious action that could steal information, damage a system or disrupt a service. A vulnerability is a weakness that could be exploited. Risk is the possible harm if a threat uses that weakness. For example, an internet-facing server that has not been updated may create a risk of unauthorised access and disruption.
What Could Cause Harm?
Criminals, malware, scams or mistakes that could affect a device, network, service or business information.
Where Is The Weakness?
For example, outdated software, weak access controls or a setting that leaves information exposed.
What Could The Impact Be?
Consider lost data, fraud, downtime, customer harm, lost sales and the cost of recovery.
What Is The Threat Doing?
Gather and analyse information about actors, their motives, capabilities and methods.
Use Intelligence To Ask Better Questions
Cyber threat intelligence helps a business understand who may be attacking, what they might want, what they can do and how they operate. Operational intelligence can help identify the actors and campaigns a business needs to pay attention to. Tactical intelligence looks at techniques, tactics and procedures, often shortened to TTPs. My personal favourite is this tactical view because it can help people recognise signs of an attack in activity or logs. Strategic intelligence looks further ahead at wider changes and emerging threats.
This does not mean a business can predict everything. It means it can make more informed choices about where to put attention and resources. Planning cannot guarantee an attack will not happen, but understanding the risks early gives you a better chance to prevent, detect and respond to problems.
Security By Design Starts Before The System Is Built
Do not build the whole system first and then try to bolt security on afterwards. Decide what safe use needs to look like from the beginning.
The System Has To Fit The Business
A bespoke system should be designed around the way a business works. The business should not have to twist itself into a process that only suits the software. That is why the first conversations matter. You need to understand the real work, the users and the information before you decide how the system should behave.
Security is considered when building it. That includes deciding what information is needed, where it should be stored, who can access it, how people sign in and what the system should do if something looks wrong. It also means keeping the design as simple as possible. Extra features that do not solve a real problem can create more places that need protecting.
Build a system that fits the business, with security part of the plan from the first conversation.
Make The Safe Choice The Normal Choice
A user should only have the access needed for their role. Administrative access should be limited. Sensitive information should be protected, and secure sign-in should be expected. Multi-factor authentication adds another check beyond a password. Strong, unique passwords matter too; a business should not rely on a password alone to protect an important system.
I used to think people should be told to change passwords frequently. Current NCSC guidance is to ask for a password change when there is an indication or suspicion of compromise, rather than forcing routine changes on a calendar. The stronger approach is to use unique passwords, help people store them safely and add multi-factor authentication where possible.
Access, Data And Recovery
Plan roles, authentication, data protection, updates, monitoring and backup needs before the system goes live.
Security As A Last-Minute Add-On
Retrofitting controls can make a system harder and more expensive to change, and can leave gaps while the work is being done.
The NCSC’s secure development guidance recommends limiting access to what is needed and using monitoring and logs to help spot unusual activity in development environments. That principle matters whether a business is building a bespoke platform or configuring a system it has bought.
If you are looking at how research can help a business understand its processes before building, see AI-Human Growth Systems’ marketing research.
Build The Controls Around The Way People Work
Good security needs technical controls and clear ways of working. People should know how to use the system safely without having to guess.
Limit Access And Reduce Unnecessary Exposure
Access should be given to the people who need it, and to the parts of the system they need for their role. Not everyone needs administrator access. Not everyone needs to see every customer record. If somebody changes role or leaves, their access should be reviewed and removed when it is no longer needed.
The system should also be protected with suitable controls: secure sign-in, multi-factor authentication, firewalls, supported software, device protection and careful handling of data. The right controls depend on the system and the risk. A small business does not need unnecessary complexity, but it does need to protect the accounts and information that keep the business running.
Give People The Training To Use It Well
I have always thought staff training is vital. People can make mistakes, but that does not mean security is only a staff problem. Businesses need clear rules and procedures so people know what to do and can use the systems as safely as possible.
That might include knowing how to spot a suspicious email or link, checking a request through a trusted route, reporting something that feels wrong and understanding which information should not be shared. Phishing messages try to deceive people into handing over information or opening something unsafe. The important thing is to make it easy for staff to ask for help rather than hide a mistake.
Security should fit the way people work. Training, clear access and sensible procedures help make that possible.
There are different kinds of malicious software. A Trojan may pretend to be something legitimate. A worm can spread between systems. Ransomware can make data unavailable and demand payment. Spyware can secretly collect information. A business does not need to become an expert in every type of malware to build protection, but it should understand that attacks can arrive in different ways and cause different kinds of harm.
Check The System Before You Trust It With Live Work
A system can look right in a demonstration and still behave differently when people, data and real business processes are involved.
Test The Controls And The Workflow
Before launch, check that people can only access what they are meant to access. Try the normal user journeys. Check what happens when someone enters the wrong information or loses access. Make sure the system handles data as expected and that connections to other services are protected.
Security testing should be authorised and planned. A good actor, such as an ethical security tester, works with permission to identify weaknesses so they can be fixed. Testing systems without permission is not the right way to help, even if someone believes their intentions are good.
Look at the wider process too. Can staff report a problem? Does the business know who will investigate? Are important data backups available, and has anyone checked that they can actually be restored? A backup that has never been tested may not be much help during an incident.
Understand
Map the business, the information, the threats and the impact of disruption.
Design
Build safe access, data protection and security requirements into the plan.
Protect
Put controls, roles, procedures and training around the way people work.
Test
Check permissions, integrations, recovery and the real user journey before launch.
Improve
Monitor, update, review and learn as the business and threats change.
Do not ask only whether the system works. Ask whether it works safely for the people who will use it.
Security Continues After The System Goes Live
Businesses change. Systems change. Threats change too. The security work has to continue with them.
Watch For What Does Not Look Right
Once a system is live, the business should know what normal activity looks like and keep an eye out for signs that something may be wrong. That can include unusual login attempts, unexpected changes, unfamiliar devices or activity outside the normal pattern. Logs can help a team understand what happened and when, provided they are collected and reviewed appropriately.
Security reviews should be part of the system’s life cycle. Software needs to be kept supported and updated so known weaknesses can be addressed. Access should be reviewed. Backups should be checked. Staff should know how to report suspicious activity. I think looking at security regularly, at least once a month for the systems we manage, is a useful discipline—but the right schedule depends on the system and its risks.
Plan For Recovery, Not Just Prevention
Even with good protection, no system can promise that an attack will never happen. A business should know how it will respond, who needs to be contacted and how important work can continue. It should keep backups of the information it needs and test that it can restore them. The NCSC recommends that small organisations protect their accounts, devices and data, and practise restoring backups.
Threat intelligence can help with this ongoing work. Tactical information can help people recognise techniques and procedures used in attacks. Operational information can help a business understand campaigns and actors. Strategic information can help it think about changes that may affect the business in future. None of that removes uncertainty, but it can help a business make better decisions before, during and after an incident.
Security is not one feature you switch on. It is a way of designing, building and looking after the system.
Good security may add time and cost at the start, and it can require specialist knowledge. It can also make a design more complex if too many controls are added without considering the users. That is why security needs to fit the business rather than overwhelm it. The aim is to protect people and information while still allowing the system to do the job it was built for.
Build The System Around The Business. Build Security Into The System.
For me, security is the most important part of building a system because people need to feel safe using it. If they do not trust the system with their information and their work, then it is not doing its job.
The five stages are straightforward to explain: understand what you are protecting, design security in from the start, protect the people and the system, test before launch, then monitor and improve it. The detail will vary from one business to another, because every business has different data, people, processes and risks.
A bespoke system should fit the business. But that does not mean security should be an afterthought. You need to think about access, data, training, testing and recovery as part of the same design. If you find a weakness later, it can be harder and more expensive to put right.
You can build a powerful system. Make sure you build the protection around it at the same time.
No system can guarantee that nothing will ever go wrong. What a business can do is understand the threats, reduce vulnerabilities, prepare its people and keep improving the controls. That gives the business a stronger chance of protecting its work and the customers who rely on it.
Further reading: NCSC Small Organisations Guide to Cyber Security and NCSC Secure Development and Deployment Guidance.