Page 13 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
RPKI lets resource holders authorize which ASN may originate a prefix and lets operators validate BGP origins. It does not validate the full AS path or prove a route is benign. Build careful ROAs, redundant validators, policy, and monitoring.
Read the playbook
Kubernetes Pod Security Admission can enforce privileged, baseline, or restricted profiles by namespace while audit and warn modes expose violations first. Govern labels, policy versions, exemptions, and controller-created Pods as one system.
Read the playbook
GitHub Actions can exchange a GitHub-issued OIDC token for a short-lived cloud credential instead of storing a long-lived key. The security gain depends on strict trust claims, least-privilege cloud roles, protected environments, and tested revocation.
Read the guide
Azure Policy exemptions preserve compliance visibility while recording a Mitigated or Waiver decision, but expiration is optional and the object remains after expiry. Treat each exemption as a governed, time-bound risk record.
Read the checklist
Terraform state binds configuration to real infrastructure and can contain sensitive data. A team needs controlled remote storage, supported locking, restricted access, serialized changes, versioned recovery, and a tested process for failed writes.
Read the checklist
NTLM is deprecated and Microsoft is preparing Windows for stronger Kerberos-based authentication. A safe retirement starts with auditing real use, assigning every dependency, repairing its cause, and testing progressively tighter blocking.
Read the playbook
MFA cannot make an already-compromised workstation trustworthy. Dedicated privileged access workstations separate administration from email, general browsing, and everyday applications so high-impact credentials and sessions begin from a controlled device.
Read the guide
Control of a domain registration can redirect websites and email, disrupt public services, or remove an organization’s online identity. Registrar access deserves named ownership, strong authentication, locks, monitored changes, and an exercised recovery plan.
Read the checklist
Memory-safety flaws remain a major source of exploitable software defects. Buyers and builders should ask for an owned roadmap covering new code, legacy components, open-source dependencies, unsafe interfaces, compensating defenses, and measurable progress.
Read the guide
IPv6 may be active on endpoints, servers, and network equipment before an organization intentionally deploys it. Unmanaged IPv6 creates a parallel path around inventories, filtering, monitoring, segmentation, and incident procedures designed only for IPv4.
Read the checklist