ATH-X Services

Risk Mitigation: Security, Compliance, and Backups

Risk mitigation isn’t glamorous, but it’s the difference between a security incident being a bad day and a business-ending event. I’ve spent my career designing systems where security, compliance, and backup weren’t bolt-on afterthoughts; they were architectural requirements from day one.

This article covers the three pillars of risk mitigation for any technology-dependent business: security best practices, compliance fundamentals, and backup strategies that actually work.

Security Best Practices

Security is about layers. No single measure is sufficient, but the right combination makes you a hard target.

Authentication

  • Use SSH keys instead of passwords for any server access. Key-based authentication is orders of magnitude more secure than password auth. (See my SSH article for setup details.)

  • Enable multi-factor authentication (MFA) on every account that supports it — cloud consoles, email, financial accounts, domain registrars. An authenticator app or hardware key is preferable to SMS.

  • Use a password manager. Every account gets a unique, randomly generated password. You remember one master password; the manager handles the rest.

  • Hardware security keys provide the strongest form of MFA. They’re phishing-resistant because they verify the domain cryptographically.

Access Control

  • Principle of least privilege: Every user, service, and application gets the minimum permissions needed to do its job. Nothing more.

  • Separate accounts for separate purposes. Don’t use your root account for daily work. Don’t use your personal email for business. Don’t share credentials between team members.

  • Review access regularly. People change roles. Projects end. Contractors leave. If you’re not removing access as aggressively as you grant it, you’re accumulating risk.

Infrastructure

  • Keep systems patched. The majority of breaches exploit known vulnerabilities that already have patches available. Automated patching for operating systems and dependencies is a minimum.

  • Encrypt data in transit and at rest. TLS for everything in transit. Encrypted volumes for anything stored. This is baseline, not optional.

  • Use a firewall and restrict network access. Only expose the ports and services that need to be public. Everything else stays behind a firewall or in a private network.

  • Monitor and log. You can’t respond to what you can’t see. Centralized logging and alerting on anomalous behavior give you the ability to detect and respond to incidents.

Compliance

Compliance is the formalization of “we take security seriously enough to prove it.” Whether you’re subject to PCI-DSS, SOC 2, HIPAA, or just want to run a professional operation, the fundamentals are the same.

Why It Matters Even for Small Businesses

You might think compliance is only for large enterprises. It’s not. If you:

  • Accept credit card payments → PCI-DSS applies

  • Handle health information → HIPAA applies

  • Store customer data → Various state privacy laws apply

  • Work with enterprise clients → They will ask about your security posture

Even if no regulation currently applies to you, building with compliance in mind from the start is dramatically cheaper than retrofitting it later.

Core Compliance Principles

  1. Documentation: Write down what you do and how you do it. Document your infrastructure, your access controls, your backup procedures, your incident response plan. If it’s not written down, it doesn’t exist from a compliance perspective.

  2. Access controls: Who has access to what, and why? This needs to be documented, reviewed, and auditable. Use role-based access control where possible.

  3. Encryption: Data at rest and in transit must be encrypted. This is a requirement in virtually every compliance framework.

  4. Logging and monitoring: Maintain audit trails. Who logged in, when, from where, and what did they do? Retain logs for the required period (often 90 days to one year minimum).

  5. Incident response: Have a plan for what happens when something goes wrong. Who gets notified? What gets shut down? How do you communicate with affected parties? Write it down before you need it.

  6. Regular review: Compliance isn’t a one-time checklist. Review your controls periodically. Test your backups. Verify your access lists. Run vulnerability scans.

Multi-Account Strategy (Cloud)

If you’re on a cloud provider, use a multi-account strategy to isolate workloads:

  • Production in its own account with the strictest controls

  • Development and staging in separate accounts

  • Logging and security tools in a dedicated account

  • Billing centralized with cost allocation tags

This limits blast radius. A compromised development credential can’t touch production data. Service control policies enforce guardrails across all accounts.

Backups

Backups are the most important risk mitigation you can implement, and the most commonly neglected. I’ve seen organizations lose data because they assumed backups were happening without ever verifying.

The 3-2-1 Rule

The minimum viable backup strategy:

  • 3 copies of your data

  • 2 different storage media or technologies

  • 1 copy offsite (or in a different cloud region/account)

Example: Your data lives on your server (copy 1), is backed up to a local NAS with rsync (copy 2), and replicated to cloud storage in another region (copy 3).

Backup What Matters

  • Configuration files and infrastructure-as-code: Rebuilding from scratch is fast if you have your configurations. Without them, you’re reverse-engineering your own systems.

  • Databases: Use native database dump tools (pg_dump, mysqldump) for logical backups in addition to filesystem-level snapshots.

  • User data and documents: Anything that can’t be regenerated from code.

  • Secrets and credentials: Backed up separately, encrypted, with strict access controls.

Verify Your Backups

A backup you’ve never restored is a hope, not a backup. Regularly:

  • Test restores. Pick a random backup and restore it to a test environment. Does it work? Is the data complete?

  • Check backup freshness. Script a check that alerts you if the latest backup is older than expected. (See my Automation article for an example.)

  • Monitor backup jobs. Backup scripts fail silently more often than you’d like. Log output, check exit codes, and alert on failure.

Automation

Backups must be automated. Manual backups are backups that get forgotten.

  • Use cron to schedule rsync jobs or database dumps

  • Use cloud-native tools (AWS Backup, EBS snapshots, S3 versioning) for infrastructure

  • Use version control (Git) for code and configuration; this is your first line of backup for anything text-based

Retention

Keep backups long enough to recover from problems you didn’t notice immediately:

  • Daily backups retained for 30 days

  • Weekly backups retained for 90 days

  • Monthly backups retained for one year

Adjust based on your data’s value and your compliance requirements.

Putting It All Together

Security, compliance, and backups aren’t three separate concerns; they’re three facets of the same goal: making sure your business survives when things go wrong. And things will go wrong.

Start with the basics:

  1. Enable MFA everywhere

  2. Use a password manager

  3. Automate your backups and verify them monthly

  4. Document your infrastructure and procedures

  5. Keep your systems patched

These five steps put you ahead of the majority of small businesses. Build from there as your needs grow. The tools exist, most of them are free, and the cost of not implementing them is always higher than the cost of doing it right.

Personal Security Is Part of Organizational Security

Many of the security incidents that I have dealt with in the corporate world were due to a breach in one member’s security. At many roles I worked in, I had administrative access to every system and machine in the organization. Even junior developers have access to documentation and source code. Every individual and workstation must have hardened security and vigilant privacy. Your production systems are only one authorized connection away from your co-workers.

Even if you take professional life out of the picture, privacy and security are just as, if not more important in your private life. You do your banking and finances on your personal devices. Your home alarm, cameras and automation is likely controlled by your computer and/or mobile devices. Family photos and email are on your devices.

  • Keep your operating system and browser updated.

    • These are your primary attack surface.

  • Be skeptical of links and attachments.

    • Phishing remains the most common attack vector.

    • Verify that the domain of the sender matches what the message represents.

  • Separate your work and personal environments as much as practical.

    • Different browsers, different email accounts, different password vaults; ideally, different computers.

  • Network and devices should be secure.

    • Use passwords

  • Passwords should be encrypted.

    • I have been using KeePass for years, but a more modern, convenient solution is Proton Pass.

  • Communications should be encrypted.

    • I use GPG encryption in my email. It is fairly easy to set up a public key and add it to your email client. The only problem is that I have to leave my messages unencrypted to anyone who doesn’t use GPG or PGP.

    • I am beginning to migrate my mail over to Proton. It handles the encryption and automatically encrypts mail to anyone else who uses their mail service, even when they use their own domain.

  • Use a VPN when you are on a public network.

    • Whoever controls the network can inspect all of your data packets, all of your DNS queries, and all of your traffic. That’s too much privacy to trade for some free WiFi.

    • Encrypt all of that with a Virtual Private Network (VPN).

    • Many VPNs cost money; I have been using the free-tier Proton VPN for years. It is fast enough to stream audio and video when I’m at the gym with no glitches.

    • The VPN you get with a cheap, paid Proton mail account is probably the best option at any price.

  • Back up your files!

    • Computers break, phones get lost. Copy your photos and documents to a seperate drive.

The Proton offerings are affiliate links. The links will usually lead to a great deal on an already reasonably priced service; it costs you nothing and helps support this site. All of the Proton services listed in this section have a free plan available, so you don’t need to spend anything to use them. The Amazon link is also an affiliate link to a solid, well priced backup drive.