Monitor DNSSEC trust-anchor rollover as a resolver lifecycle
Verify that validating resolvers can maintain DNSSEC trust anchors through updates, restarts, and extended offline periods.
Read the checklistDSE security knowledge hubCybersecurity
Cybersecurity
Knowledge
Page 170 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Cybersecurity knowledge center
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
DSE post stream
1,892 articlesCybersecurity
Enable QNAME minimisation as one DNS privacy layer
Reduce unnecessary query-name disclosure from recursive resolvers while preserving a tested compatibility and fallback path.
Read the explainer
Protect syslog in transit without mistaking TLS for log durability
Authenticate and encrypt syslog transport while separately engineering buffering, retention, integrity, and collector availability.
Read the guide
Build an IPsec profile before negotiating each tunnel by exception
Standardize IPsec and IKE choices, lifecycles, monitoring, and exceptions before adding more site-to-site VPNs.
Read the playbook
Qualify EAP-TLS 1.3 across supplicants, RADIUS, and certificates
Test the complete 802.1X authentication chain before introducing TLS 1.3 behavior for EAP-TLS.
Read the guide
Treat every SSH user key as a persistent access grant
Bring enterprise SSH user keys into provisioning, review, monitoring, termination, and evidence workflows.
Read the playbook
Pilot Experimental RADIUS/1.1 without silently breaking AAA
Treat RADIUS/1.1 over TLS or DTLS as an experimental interoperability project with explicit fallback and authorization tests.
Read the briefing
Require independent authorization for destructive Azure Backup operations
Use Azure Backup multi-user authorization and Resource Guard to separate routine backup administration from approval of protected operations.
Read the playbook
Prove an AD CS certification authority can be restored—not merely backed up
Validate the complete Certification Authority recovery set, including database, private keys, configuration, templates, revocation publishing, and HSM steps.
Read the checklist
Make federation trust explicit before accepting another identity provider's assertion
Federation moves authentication information between separately administered parties. Document which provider, assertion, attributes, audience, assurance, and failure paths each relying service will accept.
Read the guide