Page 290 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
An alternate chat room is not enough when attackers can monitor normal tools or impersonate responders. Pre-provision independent communications, verify identities through trusted records, and exercise degraded-mode operations.
Read the playbook
Synthetic voice and video can make an impostor look familiar. Remove media familiarity from help-desk resets, executive requests, and payment approvals; verify through independent identity and workflow controls.
Read the checklist
Insider risk cannot be managed by surveillance alone. Use multidisciplinary governance, critical-asset controls, narrowly justified monitoring, human review, support pathways, privacy safeguards, and consistent response.
Read the guide
A board dashboard should connect cyber exposure and control evidence to enterprise objectives, risk tolerance, accountable owners, and decisions. Replace unbounded activity counts with trends, denominators, uncertainty, and asks.
Read the guide
Forest recovery is a controlled rebuild of the organization’s identity service. It requires trusted backups, an isolated recovery sequence, privileged credential resets, dependency validation, and rehearsed business acceptance—not simply a restored domain controller.
Read the playbook
Microsoft Entra Connect is replaceable only when its configuration, advanced exceptions, credentials, failover order, and validation evidence are ready. Staging mode lowers recovery time, but it is active-passive—not active-active.
Read the playbook
NIST NCCoE treats TLS server certificates as an enterprise operating program: policy, discovery, ownership, controlled issuance, key protection, automation, monitoring, emergency replacement, and auditable evidence.
Read the guide
ScubaGear can compare Microsoft 365 configuration with CISA's SCuBA baselines. A defensible program also controls permissions, versions, configuration, exceptions, evidence, remediation, reruns, and drift interpretation.
Read the playbook
Managed identities, service principals, and user-based service accounts can retain access without human visibility. Choose the safest type, record ownership and purpose, control permissions and credentials, monitor use, and retire dependencies safely.
Read the guide
As of August 4, 2026, Windows 10 ESU Year 2 planning requires an edition-and-version inventory. Commercial 22H2 ESU is annual and cumulative; LTSC and LTSB releases follow separate lifecycles and must not be grouped with 22H2.
Read the guide