DSE UpdatesDetection Systems & Engineering
DSESecurity.com
DSE security knowledge hub

Security knowledge,
without the noise.

Page 281 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.

DSE-authoredOfficial sourcesReviewed guidance
Search the library
DSE post stream

Guidance and analysis from DSE

3,000 articles
DSE visual briefIdentity & cloud
BriefingImportantCybersecurityMicrosoft 365 & Identity

Microsoft Entra Retires Native SMS and Voice MFA in 2027—Prepare for Passkeys Now

Microsoft began rolling out passkeys as the default in public-cloud Microsoft Entra ID tenants on September 1, 2026. Microsoft-provided SMS and voice authentication is retired February 1, 2027 for most users and July 1, 2027 for Global Administrators and external users; organizations must migrate users to a phishing-resistant method or configure a telephony provider through Microsoft Security Store.

Published Reviewed 6 min readBy Gavin Stewart
Read the briefing
DSE visual briefContinuity & recovery
GuideImportantBusiness ContinuityIT

Place a failover-cluster witness outside the failure domain it must arbitrate

A quorum witness is a deciding vote, not a decorative cluster setting. Select cloud, disk, or file share from the topology; isolate its dependencies from the failures it must resolve; validate access from every node; and retest after cluster or site changes.

Published Reviewed 3 min readBy Gavin Stewart
Read the guide
DSE visual briefNetworks & infrastructure
ChecklistImportantITNetworks & Infrastructure

Govern Windows DNS scavenging as a deletion change, not routine cleanup

Windows DNS aging can identify stale dynamic records, and scavenging can delete them. Inventory timestamps and registration owners, align intervals with DHCP and client behavior, restrict scavenging servers, pilot one zone, and prove recovery before enabling automation.

Published Reviewed 3 min readBy Gavin Stewart
Read the checklist
DSE visual briefManaged IT operations
PlaybookImportantBusiness ContinuityCybersecurity

Govern every sensitive information exchange through its full lifecycle

Information remains exposed before, during, and after an exchange—regardless of whether it moves through an API, portal, file transfer, email, shared database, or manual process. Put protection duties and exit conditions in an owned agreement.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the playbook
DSE visual briefContinuity & recovery
GuideImportantBusiness ContinuityCybersecurity

Rank critical components by mission consequence, not replacement cost

The most expensive asset is not always the component whose loss matters most. Trace organizational goals through programs, systems, functions, and components so protection, acquisition, maintenance, and recovery follow operational consequence.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the guide
DSE visual briefContinuity & recovery
GuideAdvisoryBusiness ContinuityCybersecurity

Use TLP 2.0 to preserve the sharing boundary of incident information

Threat and incident information loses value when recipients cannot tell who may receive it. Use the four TLP 2.0 labels consistently, keep the source’s marking intact, and add separate handling instructions when TLP does not answer the need.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the guide
DSE visual briefContinuity & recovery
PlaybookImportantBusiness ContinuityCybersecurity

Design cloud forensic readiness before evidence is needed

Cloud investigators depend on provider capabilities, customer configuration, jurisdiction, interfaces, time, and retention that cannot be improvised after an incident. Map evidence needs to cloud capabilities and mitigate gaps before collection becomes urgent.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the playbook