Online service growth and business security

What is in­ter­net de­vel­op­ment and busi­ness security?

Internet growth moved business data and work into SaaS, APIs, mobile devices and remote connections. Security now depends on knowing which domains and public services exist, who owns them, how identities are protected and how an online service is monitored and recovered. The useful boundary is the business process, not merely the office network.

What has changed since the first predictions

The main challenge used to be the growing volume of data on the network. Today, the problem is broader: data is scattered between laptops, the cloud, email, SaaS applications, phones, partner systems and IoT devices. Information protection must operate beyond the office perimeter.

• More online services mean more accounts, tokens, integrations and data storage.
• Hybrid working has shifted security from the office network to user identity and device status.
• Automation and APIs speed up work, but require control of keys, logs and permissions.

More data and services need effective controls

Before adding an application, identify its owner, the data it processes, access permissions and how information will be recovered. Protection requires management of identities, devices, retention periods, logs and incident response across the services involved.

• Greater data volume increases the importance of classification, information ownership and retention.
• More web applications mean more accounts, permissions, tokens, and vendor dependencies.
• Data processed outside the office requires MFA, backup, encryption, monitoring and clear procedures.
• Management should see evidence of control, not just a declaration that systems are cloud-based or online.

How service growth changes network architecture

More services introduce accounts, dependencies and data flows. Design networks alongside identity and device protection, application access and monitoring. A new connection should not automatically expose the whole infrastructure.

Changes driven by modern technologies

Modern technologies increase the convenience of work, but transfer responsibility from a single server room to the entire digital ecosystem. The company must control users, devices, applications, data, integrations, vendors and automations. This requires a process that combines cybersecurity, IT outsourcing, backup, Microsoft 365 and compliance with customer requirements.

• Greater dependency on email, instant messaging, SaaS applications, and the public cloud.
• More endpoint devices that need to be updated, encrypted and monitored.
• More automation, API integration and service accounts requiring rotation of service passwords and access keys and logging.
• Increased customer requirements for ISO 27001, NIS2, DORA, backup and security evidence.
• Greater need for ongoing IT maintenance rather than one-time tool configuration.

Prioritising service protection

Protect accounts, public services and data first: MFA, updates, backups, restricted access and alert response. Do not postpone urgent gaps until day 60. Reviews after 30/60/90 days assess effectiveness and progress; choose additional tools for demonstrated risks.

• Start by reviewing accounts, MFA, administrator access, and legacy protocols.
• Check the backup, retention, recovery tests and data in Microsoft 365 and SaaS.
• Evaluate network, VPN, segmentation, firewall, Wi-Fi and service exposure to the Internet.
• Implement monitoring of logs, alerts, availability and security incidents.
• Maintain an evidence package for management, auditor, client or cyber insurance.

The most important risks for companies

The development of the Internet is not a problem in itself. Risk occurs when a company adds new services faster than it updates security, backup, monitoring, vendor contracts and response processes. Uncontrolled growth creates shadow IT, forgotten accounts, public links, missing backups, unmanaged integrations and unclear ownership. Weak MFA and incomplete logging then turn one stolen credential into account takeover, data loss or an outage with no clear escalation owner.

• Orphaned accounts, old administrator rights and missing MFA increase the risk of account takeover.
• Files are shared through public links, personal clouds or undocumented SaaS services.
• Backup covers local servers but omits critical cloud data, configurations or SaaS content.
• API keys, service accounts and automation run without rotation, logging or an owner.
• Alerts, logs and response processes are disconnected, causing incidents to be detected late.

Identity checks are the new security frontier

In a cloud environment, a user often connects from outside the corporate network. Therefore, MFA, roles, conditional access, permission reviews and prompt access revocation after a job change or an employee's departure become the basis.

• Enable MFA for users and administrator accounts.
• Block legacy protocols that bypass modern authentication mechanisms.
• Review permissions for email, SharePoint, file servers and business applications.
• Separate administrator accounts from everyday user accounts.
• Monitor logins from unusual locations, devices and times.

Network, VPN and segmentation

VPN still matters, but it should be part of the access architecture, not the default tunnel to the entire company. Segmentation, firewall, guest Wi-Fi, server rules and traffic monitoring limit the effects of an incident.

Backup and recovery after an incident

The more data that enters online services, the more important the question is whether the company can recover it. Backup should cover not only local servers, but also critical data in the cloud, configurations and retention policies.

• Determine which data is critical and what is an acceptable recovery time.
• Separate backup from the production environment and limit administrative access.
• Test recovery within an agreed, isolated scope without overwriting production data.
• Set retention by data category and requirements, then reconcile it across systems; do not assume one period fits all data.

Data protection evidence in the online environment

Companies need material that shows security measures work. An evidence package helps with ISO 27001, TrustGuard, customer audits, cyber insurance and management decisions. Keep a register of domains, public IP addresses, remote access, providers and named owners. Add approved exposure rules, certificate and alert checks, test results, exceptions and the next review date.

• Report on MFA, administrator accounts, conditional access and risky logins.
• Map of SaaS services, data owners, API integrations, service accounts and permissions.
• Test results for backup, retention and restoration of data from local and cloud services.
• Monitoring report: availability, security alerts, login anomalies and incident responses.
• List of supplier risks: SLA, processing location, subcontractors, data export and exit plan.

How Virtline organises data protection

The review covers accounts, public services, networks, devices, cloud and recovery. We agree priorities, owners, tests and change windows. We reduce operational impact, but necessary downtime or access restrictions must be agreed rather than promising entirely disruption-free changes.

What the client gets after the review

The goal is not to provide a general report on internet trends. The client receives a short list of decisions, evidence and technical changes that can be implemented in order from greatest risk to development work. Sales, customer service and collaboration now depend on public applications, SaaS, APIs and remote access. A domain, certificate or identity failure can therefore stop a business process just as effectively as a server outage.

• Map of web, cloud and on-premises services with owner, data type and business criticality.
• Accounts, groups, API integrations and remote access requiring MFA, restricted permissions or review.
• Priorities for backup, retention, recovery tests and data beyond the classic file server.
• Recommendations for VPN, segmentation, firewalls, Wi-Fi, end devices and login monitoring.
• Supporting evidence for the management board, client or auditor: what works, what requires a decision and how to verify that a fix works.
• Priorities reflect the cost of outage, account takeover and loss of customer-facing data.
• Unused endpoints are removed; justified exposure receives monitoring and an expiry or review condition.
• Domain, API and supplier changes update the inventory and the related recovery and escalation steps.

Why you should do this with Virtline

The development of the Internet affects many areas at once: email, cloud, network, devices, backup, automation and regulation. Virtline combines these areas into a single technical plan, rather than selling a single tool without responsibility for the whole. It is best to build data protection in layers: identity, device, network, backup, monitoring and procedures. Together, these layers align the organisation's use of internet technologies with operations, risk management and governance.

When to run a review

It is worth performing the review after the implementation of new online services, email migration, change in the work model, an incident or before a client audit. Then the general topic of Internet development turns into a specific list of risks. The topic is especially important for organisations with several locations, external suppliers, sensitive data, ISO 27001, NIS2, DORA or customer-audit requirements, and for companies introducing digital services quickly.

• The company quickly added SaaS applications, but did not review accesses.
• Users work remotely, while VPN and MFA were deployed hastily as temporary controls.
• It is not known which data is backed up and whether the restoration was tested.
• There is no monitoring of logins, alerts and basic security events.
• The client or auditor asks for evidence of information protection.
• Businesses subject to ISO 27001, NIS2, DORA, insurance requirements, customer reviews or supplier contracts.
• Teams that built automation, API integrations or cloud services without a central security review.

Why is traditional network security no longer enough?

Protection used to focus on the firewall, server room and local network. Today, users work from many locations, data resides in Microsoft 365, SaaS, mobile devices and partner platforms, and integrations run through APIs. Security architecture must therefore connect identity, devices, cloud services, backup, logs and response processes. No single tool can solve this task.

• Users access company data from the office, home, while travelling and through private networks.
• SaaS applications store files, customer data, reports, tokens and integrations outside the company network.
• APIs and automation speed up processes but require key management, logging and permission reviews.
• IoT, mobile devices and external service providers add risks that are harder to see.
• Customers, insurers and auditors expect evidence that security controls actually work.

Acceptance criteria for internet development and business security

Every public service needs an owner, approved exposure, protected administrator access, useful logs and an alert route. Acceptance also confirms certificate renewal, a recovery and escalation test, and documented exceptions with a deadline and accountable person.

Review the risks in your online services

Send the list of domains, externally available systems, remote-access methods and the decision deadline. We will identify whether the first useful step is inventory, exposure review, identity hardening, monitoring or a recovery test. Call +48 12 200 27 10 with the public domains, applications, remote-access methods and the service whose outage would hurt most.