Inheriting an environment.
WHEN THIS HAPPENS
You acquire a business A developer or employee leaves You take over a client's systems
WHAT TO ASSUME
That you do not know who has access.
WHAT TO DO FIRST
Change every credential you control Review every account on every system Review connected applications and keys Check for forwarding rules and scheduled tasks
WHY THOSE LAST TWO
They are how previous access persists quietly.
WHAT TO ESTABLISH
What exists: devices, accounts, services, data
Who else holds access What is out of date Where backups are, if any
WHAT YOU WILL USUALLY FIND
Shared logins Accounts for people long gone Unsupported software No backups
WHAT TO PRIORITISE
Email and domain control Financial system access Removing anyone who should not have access
WHAT TO DOCUMENT
The state you inherited.
WHAT NOT TO ASSUME
That the previous arrangement was secure.
