Engineering write-ups on cybersecurity from deployments KYCONNECTS has run, with the reasoning behind each approach.
Page 2 of 2
Disabling someone's account is the visible part of offboarding and the smallest part. What survives is the access nobody recorded: certificates, service accounts, shared credentials, and integrations built under a named person's login.
Most businesses keep everything forever because deleting requires a decision and keeping does not. That default is a growing storage bill, a growing breach exposure, and in several jurisdictions a compliance failure.
A firewall's value is not what it blocks. It is whether anyone can still state, accurately, what it permits — and in most rule bases over a few years old, nobody can.
A password committed to a repository is compromised the moment it lands, and deleting the line does not undo it. Rotation is the only remedy, which is why most businesses cannot actually respond to a leak.
An agent portal on shared hosting needed call data from a MySQL instance on a PBX VPS. Opening that database to shared hosting was not acceptable. Here is the API proxy pattern used instead, and why it is stronger than a firewall rule.
We typically respond within 4–8 business hours.
