u/deathbeforedishonor2

I'm a backend dev and recently got the opportunity to start taking care of the cybersecurity side of the company I work for.

There's not really a mature security process in place yet, so my first task is basically mapping everything we have. Technologies, servers, applications, infrastructure, external services, who has access to what, exposed stuff, etc. The idea is to understand the environment first and then figure out what we actually need to secure/test and how.

I'm pretty new to security professionally. I've been doing PortSwigger labs, started some certs and I'm reading/studying a lot on my own, but this is obviously pretty different from doing labs lol

For people who have done something similar, how would you approach this first mapping phase? What would you document? Any methodology, books, tools or resources you guys think are worth looking into?

Also interested in hearing about mistakes you made when you were starting out. Just trying not to reinvent the wheel here