Access and recovery
Review administrator ownership, multifactor authentication, recovery paths and the dependencies left by staff or provider changes.
Practical defensive help for New Zealand small businesses
Reduce avoidable risks in your business accounts and systems
Unsure who has administrator access, whether a remote service should be public or how the business would recover an account? I help turn those concerns into an agreed review and practical improvements.
Talk directly with John Finnerty. We will confirm the scope and charging basis before work starts.
Start with the systems and accounts you rely on
Publicly reachable services
Review agreed internet-facing systems using available evidence, then confirm what is expected and what needs attention.
A useful action list
Explain findings in business terms, prioritise the next steps and work with your existing provider where needed.
Work is limited to systems you own or are authorised to manage and an agreed scope. A review identifies evidence and practical next steps; it is not a guarantee that a system is secure.
Starting the work
A clear scope before you commit
1. Tell me what is happening
Describe the concern and the systems you are authorised to manage. Do not include passwords, recovery codes or sensitive customer information. You do not need to diagnose it first. Do not send passwords or recovery codes.
2. Agree the next step
I will confirm whether I can help, what access is needed and whether the work suits remote or onsite support. We agree the scope and charging basis before changes begin.
3. Check and hand over
The handover records what changed, the checks completed and anything that still needs your provider or another specialist.
If the scope changes, we agree the next step before additional work.
Tell me what you would like to sort out
A short description is enough to start. I will help work out which part of the setup needs attention.
Technical detail and reference checks
For the person managing the system, the following notes explain the checks in more detail.
Read the technical scope and checks
My approach
Make the business harder to compromise
I am John Finnerty, a Christchurch-based software developer and technology consultant. Defensive cybersecurity means reducing exposure, strengthening access controls and improving the ability to spot and recover from problems.
For a small New Zealand business, that work needs to fit around real systems and a working day. It might mean reviewing an internet-facing service, tightening remote access or working through Microsoft 365 account security with your existing IT provider. I can help remotely across New Zealand, with onsite work in Christchurch where appropriate.
I use Shodan as one source of information about publicly reachable systems. My aim is to turn a possible concern into a clear explanation and an agreed next step, with enough evidence for you or your provider to check it.
Evidence before conclusions
How Shodan fits into my work
Shodan indexes information returned by internet-connected services, such as service banners and software details. That can help highlight systems worth reviewing. A result is an observation to assess in context: when was it collected, does the system belong to the business and is that exposure still present? How Shodan works.
Some vulnerability associations are inferred from software metadata and can be false positives. Shodan distinguishes verified and unverified entries. A version label or a public login page alone does not establish a working exploit, an intrusion or a breach. I keep the observation, possible implication and validation still needed clearly separated. Shodan's vulnerability guidance.
Any active testing, authenticated review or configuration change needs the owner's permission and an agreed scope. Client details and sensitive findings belong in a private exchange with the responsible owner or provider.
Practical next steps
A clear path from concern to improvement
- Establish the facts. Confirm ownership, the affected service and what the available evidence actually shows.
- Prioritise the work. Consider exposure, exploitability and business impact together. A short list of consequential fixes is more useful than an unexplained scanner score.
- Agree and make changes. Work with you or your IT provider on updates, access restrictions and account controls, with a recovery plan for changes.
- Recheck and document. Record what changed, what was verified and which questions still need attention.
Related support includes Microsoft 365 and account access, email authentication, business networking and backup planning. Continuous monitoring, specialist testing or incident response needs a separately agreed scope and the right provider.
If I have contacted you
A security message should be easy to verify
If you receive a message from me about a possible cybersecurity issue, you can check who I am through my About page and the contact details on this website. You can also ask your existing IT provider to review the observation independently.
A useful notification explains what was observed, why it may matter and what remains uncertain. You do not need to share passwords or MFA codes, grant access or purchase support to acknowledge a notification. If I have linked the wrong system to your business, tell me so the record can be corrected.
Independent technology consulting from Christchurch. Remote support across New Zealand and Christchurch service context. See the privacy notice before sharing personal information.