Security & web practice · New York
Break it before someone else does. Then build something worth defending.
NYRICH is a small practice with two disciplines. Offensive security and identity engineering for organizations that have something to lose. Design, build, and hosting for businesses that need a website done right and kept that way.
- Target
- Public ranges, two identity providers, remote access
- Window
- 10 business days, off-hours by agreement
- Rules
- No denial of service, no production data exfil
- Deliverable
- Findings ranked by exploitability, fix plan, retest
01 · Security
Find the weakness first. Fix the access that lets it matter.
Most breaches are not clever. They are a reachable service, a reused credential, and an account with more privilege than anyone remembers granting. The work is to find those paths the way an attacker would, then close them at the identity layer where they actually get used.
Adversary simulation
Real-world attack scenarios against your infrastructure, tailored to the threats your business actually faces. Reported by exploitability, not by scanner count, with a retest included.
Privileged access engineering
Vaulting privileged passwords, proxying and recording admin sessions, centralizing sudo policy, and hardening the authentication services everything else depends on. Design, deployment, and clean-up of what grew organically.
Readiness, not paperwork
HIPAA-aware handling of patient-facing systems and data, and the evidence an auditor asks for produced as a by-product of doing the work properly rather than a separate exercise.
How an engagement runs
Targets, rules of engagement, and success criteria agreed in writing.
Manual work within the window. You get a call, not a ticket, for anything critical.
Findings ranked by how they would actually be used, each with a fix you can hand to an engineer.
Fixes verified against the original findings. Closed means proven closed.
02 · Design & Hosting
Websites built, branded, and hosted under one roof.
Eighteen years of building sites, logos, and corporate identities for businesses that want to look established and be found. The difference here is what happens after launch: the site runs on infrastructure I maintain myself, hardened the way a security practice would.
Web development
Responsive, fast, and built for the people who will use it: appointment booking for a clinic, registration for a youth league, quote requests for a contractor.
Logo and identity
A mark that survives being shrunk to a favicon and blown up on a truck door, with the colour, type, and usage rules to keep it consistent everywhere it appears.
Hosting and care
Your site on infrastructure I run, not a shared plan. Each site isolated from its neighbours, patched automatically, backed up regularly, certificates renewed without anyone opening a ticket.
What "hosted properly" means here
The same standard applied to client sites as to a security engagement. Nothing exotic, just the things that are usually skipped.
- Every site isolated from its neighbours, so a problem on one cannot reach another.
- Encrypted on every site, with certificates issued and renewed automatically.
- Security updates applied automatically, and regular backups you never have to think about.
- Firewalled at the network edge and on the host, with only what the public needs left open.
- Response
- Same business day
- Updates
- Applied automatically
- Backups
- Nightly
- Certificates
- Renewed automatically
- Monitoring
- Uptime and expiry watched
- Contact
- The person who built it
03 · Work
Built and hosted for businesses in New York.
A generator dealer whose phone has to ring, a youth football program that registers hundreds of families each season, a contractor's brand taking shape. Live sites, running on the infrastructure described above.
Also built and hosted: Proscape Construction, Hosgood.co.
Contact
Start with a conversation, not a proposal.
Tell me what you are worried about or what you need built. You will hear back from me directly, usually the same business day.