Knowledge base / Hardening
Practical defensive baselines for the systems small teams actually run, with rollback planning and verification built in.
Design RouterOS around roles, zones and policy before the network becomes complicated. Add VLANs, VPNs, servers and additional WAN links later without rebuilding the security model.
Use 2026 evidence to plan the next security budget around identity, exposed systems, recovery, telemetry, suppliers and AI — before buying another dashboard.
A practical Windows hardening guide for small businesses. Secure local administrators, Defender, BitLocker, RDP, firewall, LAPS, ASR rules, Office macros, updates and backups without building an enterprise security department.
Understand what a web application firewall does, when it is useful, where it fails, and how to deploy Cloudflare Free or OWASP CRS without locking out real users.
Prevent injection with parameterised APIs, typed allowlists, shell-free design, contextual encoding, least privilege and deployment-level regression tests.
A problem-and-solution hardening runbook for Ubuntu Server, Debian and Rocky Linux: patching, SSH keys, firewalls, Fail2ban, AppArmor or SELinux, audit logs, file-integrity checks and proof that the result actually works.
Separate administration from daily work, require strong authentication, reduce standing privilege, and prepare monitored emergency access.
Reduce exposed authentication paths, require managed keys, limit privilege, and verify access before closing the existing session.
Use Microsoft’s baseline as a starting point, stage changes, record exceptions, and test both security and business workflows.
Protect the management plane, remove unnecessary services, constrain the firewall, and make configuration recovery routine.
Reduce daemon authority, container privilege, mutable images, exposed sockets, and unbounded resources.
Inventory enterprise applications, permission grants, credentials, owners, and real use before removing stale or excessive access.
Separate backup identity and infrastructure, keep immutable or offline copies, and prove recovery with measured exercises.
Harden registrar identity, transfer controls, DNS changes, mail records, certificate policy, and recovery contacts.
Set safe transport and browser policies, but verify application compatibility and avoid treating headers as a substitute for secure code.
Collect the events responders need, protect the pipeline, and assign alerts before expanding volume.