Network, identity and data security
We design and deploy multi-layered protection for IT environments. We combine hardware perimeter firewalls in HA clusters, network segmentation (VLANs), independent directory services (Active Directory, Samba), strict identity policies with multi-factor authentication (MFA) and immutable 3-2-1 backup. We build operational resilience — from the cabling in the server rack to your employees’ everyday habits.
The PCS approach to security
Most incidents and crippling ransomware attacks don’t start with sophisticated code-breaking but with mundane mistakes: passwords sent by email or written down on scraps of paper, no second login factor (MFA), a flat network with no zoning, and user accounts with excessive administrative privileges.
At PCS, we build security in layers. We match the technology to your budget — we deploy directory services based on Windows Server as well as on Linux servers free of costly licenses (Samba AD). We help organizations define and implement realistic security policies, eliminate plaintext password sharing with dedicated tools (such as Password Pusher) and train users to recognize phishing attempts.
Layers of protection
Protection is effective when the layers reinforce one another instead of working as isolated tools.
We deploy advanced UTM / NGFW firewalls, often configured as redundant high-availability clusters (HA failover). We divide the infrastructure into logically separated networks (VLANs) — isolating workstations from production servers, databases, building automation (IoT/AV) and guest networks, and blocking lateral movement in the event of an infection.
We introduce centralized identity and permission management based on the principle of least privilege. We deploy and configure domain controllers on Windows Server or on Linux-based Samba — the latter removes the need to buy expensive CALs. We enforce password complexity policies and account lockouts after failed login attempts.
We close human and communication gaps. We enforce mandatory two-factor authentication (2FA / MFA) for email, cloud systems and VPN connections. We replace insecure ways of sharing credentials with encrypted, expiring links (such as Password Pusher). We help management define information security policies and run hands-on anti-phishing training for employees.
We build a backup policy that genuinely protects against encryption by ransomware. We follow the strict 3-2-1 rule: production data, a local copy and an immutable repository at a separate physical location (off-site / immutable storage / air gap). We regularly run test restores of systems, verifying in practice that the agreed recovery targets (RTO and RPO) are achievable.
Methodology and implementation process
We don’t deploy tools blindly. We start with an inventory of the physical and logical state of your infrastructure, identify real threat vectors and harden the environment according to business priorities.
We map the complete network topology, perimeter devices, workstations and servers. We verify firewall configurations, the permission structure in the domain (Active Directory / Samba), the state of physical network wall ports and whether network device firmware is up to date.
We test the network’s resilience to lateral movement. We verify the actual isolation of guest networks, automation devices (IoT) and meeting rooms (AV). We assess credential hygiene, password-sharing procedures and the organization’s susceptibility to phishing.
We categorize risks: from critical vulnerabilities requiring immediate action (no MFA on email and VPN, open high-risk ports, no isolated off-site backup) to long-term upgrades. We schedule the work so that the rollout doesn’t disrupt day-to-day office operations.
We deploy firewall clusters, separate VLAN zones and introduce strict access policies, secure password handling and two-factor login. We close the project with hands-on backup restore tests (Disaster Recovery) and staff training.
Every audit ends with a report: a description of your infrastructure’s current state, a list of identified vulnerabilities ranked by risk, and specific recommendations — from urgent fixes to a modernization plan. Depending on the scope of the contract, we can start implementing the recommendations right away.
Security architecture
We integrate office devices, multimedia and critical
server infrastructure into one controlled ecosystem.
Between potential entry points and your key
data, we build a multi-layered barrier of filtering, inspection
and strict access rules.
Video conferencing cameras, codecs, touch panels and IoT devices.
Media players, information kiosks and public information screens.
Employee laptops, smartphones, VPN tunnels and internet traffic.
A central UTM firewall that filters every packet, blocks lateral movement and verifies user identity.
Virtual environments (Proxmox/Hyper-V), ERP systems and sensitive SQL databases.
Physically and logically separated (air-gapped) backup repositories that withstand ransomware.
An environment that resists disruption — an incident in a meeting room doesn’t reach the servers.
Business continuity and Disaster Recovery
A fire, a power outage, a failed storage array controller or a ransomware attack doesn’t have to paralyze your organization. We verify security in practice — we build contingency plans, design isolated repositories and regularly test system recovery procedures under time pressure.
When to start
Most organizations call in specialists only after ransomware has encrypted their drives or the company database has leaked. We help you close vulnerabilities on your own terms — methodically, without panic and without bringing the office to a standstill.
Situation
Backups supposedly run, but no one has checked in months whether the virtual machines and SQL databases can actually be started from them.
What PCS does
We implement the strict 3-2-1 rule with an isolated (air-gapped) repository and run a trial restore of the environment, measuring the actual RTO and RPO.
Situation
Employees sign in to email and the corporate network with nothing but a password, and system credentials are sometimes sent by email or instant messenger.
What PCS does
We introduce mandatory multi-factor authentication (MFA), deploy secure password-sharing tools (Password Pusher) and put identity policies in order in Samba / Active Directory.
Situation
New conference codecs, information kiosks, IP cameras and presentation systems appear in the office, plugged into the same flat network as the computers and finance servers.
What PCS does
We configure physical and logical VLAN segmentation — isolating multimedia devices and the guest network, and blocking lateral movement to critical assets.
Situation
A corporate client, an insurer or regulations (e.g., NIS2, GDPR) require formal documentation of security procedures, segmentation and network link redundancy.
What PCS does
We perform a baseline audit, harden hardware configurations, eliminate single points of failure (SPOF) and prepare complete technical documentation.
Planning to roll out two-factor authentication, want to isolate meeting-room devices, or need a no-compromise backup policy that stands up to ransomware? Talk directly to one of our engineers.
Confidential conversation with an engineer
SLA clients:
emergency contact outside business hours