Most intrusions abuse credentials. Identity controls are the highest-value hardening step. Controls Enforce multi-factor authentication, prioritising administrators and remote access. Separate admin accounts from daily user accounts. Use a privileged access management tool for credential vaulting and session recording. Grant just-in-time administrative rights. Remove default and shared accounts; rename or disable built-in administrator accounts. Use […]

Reduce the surface Install only required roles and features. Use minimal installation options where practical. Configuration Apply security baselines through group policy. Disable legacy protocols such as SMBv1 and older authentication methods. Enable host firewall with explicit rules. Restrict remote desktop to admin networks and require network-level authentication. Enable credential protection features where supported. Configure […]

Reduce the surface Use minimal installations, remove unused packages and disable unnecessary services. SSH Disable root login, use key-based authentication, restrict allowed users and limit access by network. Configuration Enforce file permissions and remove unnecessary setuid binaries. Enable a host firewall. Use mandatory access control frameworks. Configure kernel parameters securely. Mount temporary file systems with […]

Device hardening Change default credentials, use centralised authentication, disable unused services and insecure management protocols, restrict management to dedicated networks and keep firmware updated. Configuration backup Back up configurations automatically and monitor for unauthorised changes. Segmentation Separate user, server, management, guest and operational technology networks. Allow only required traffic between segments. Remote access Use VPN […]

Process Inventory assets, monitor vulnerability advisories, scan regularly, prioritise, patch, verify and report. Prioritisation Prioritise vulnerabilities known to be exploited, internet-facing systems and critical assets. Define target remediation times by severity. Testing and deployment Test patches on representative systems, deploy in rings and keep rollback plans. Unsupported systems Isolate or replace systems without vendor support. […]

What to log Authentication events, privilege changes, process execution on servers, network connections at boundaries, configuration changes and security tool alerts. Centralisation Forward logs to a central platform with protected storage and defined retention. Detection Create alerts for high-risk events such as new admin accounts, disabled security tools or logins from unusual locations. Time synchronisation […]

Virtualisation Secure hypervisor management interfaces, separate management networks and patch hosts. Cloud Apply cloud security benchmarks: least-privilege identities, no public storage by default, encryption, logging and guardrail policies. Backups Follow a 3-2-1 approach with at least one immutable or offline copy. Protect backup systems with separate credentials. Test restores regularly. Continuous compliance Scan configurations continuously, […]