Practical security for business systems: roles, secrets and backups

Security advice tends to arrive as a list of forty items. For a business system, five controls cover most of the risk that actually materialises.

1. Roles, not shared logins

One account per person, with permissions by role. Shared "admin" logins make the audit trail meaningless and make leavers impossible to remove. Role-based access is also what lets a system give the cashier, the manager and the auditor different screens.

2. Secrets out of the code

API keys, database passwords and payment credentials belong in environment configuration, not in source files or spreadsheets. Rotate them when people leave. Never expose them in a browser, a log or an error page.

3. Backups you have restored

A backup that has never been restored is a hope, not a control. Automate daily backups, keep copies off the server, and rehearse a restore at least once — it also tells you how long recovery really takes.

4. Updates on a schedule

Frameworks, libraries and operating systems publish fixes constantly. A monthly patch window, applied to a staging copy first, closes the majority of known holes without drama.

5. An audit trail that is actually read

Log who changed what, and have someone look at unusual activity — a login at 3 a.m., a price changed after invoicing, an export of the customer list. Detection is cheaper than recovery.