Page 176 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Blocking sign-in and revoking refresh tokens are important, but existing access and application sessions can end on different timelines. Run a documented containment workflow and verify effective loss of access across supported services and independent applications.
Read the playbook
Shared mailboxes outlive projects and teams unless someone owns membership, direct sign-in, forwarding, retention, licensing, automation, and closure. Govern each mailbox as a business service, not a permanent bucket of delegated access.
Read the checklist
Retention policies, retention labels, records controls, and eDiscovery holds answer different questions. Route each requirement through legal, records, privacy, workload, license, scope, deployment, validation, exception, and release decisions.
Read the guide
Group Managed Service Accounts let supported domain services use domain-managed passwords and simplified SPN management. Migration still requires application support, dependency discovery, least privilege, host authorization, staged testing, and rollback.
Read the playbook
AD CS can issue credentials used for authentication, signing, and encryption. Treat certification authorities, templates, enrollment rights, web endpoints, keys, revocation, and recovery as high-value identity infrastructure.
Read the playbook
Windows Credential Guard isolates selected secrets with virtualization-based security, but legacy protocols, delegation, security packages, remote access, firmware, virtualization, and applications can change behavior. Discover and pilot before enforcement.
Read the playbook
Browser extensions can read pages, alter traffic, and retain access long after their original purpose ends. Govern them as software: approve by need and permission, assign an owner, inventory deployment, review change, and remove them predictably.
Read the guide
A misplaced switch or unexpected bridge can change Layer 2 topology and disrupt a site. Define the intended spanning-tree root, classify ports, apply platform-appropriate protections, monitor topology changes, and test recovery.
Read the playbook
Modern devices can present private MAC addresses per Wi-Fi network and may rotate them. Inventory and network access designs that treat a hardware address as durable identity need stronger signals, documented exceptions, and tested support workflows.
Read the guide
SNMPv3 can add authentication, integrity, privacy, and scoped access, but a rushed cutover can silently drop polling or notifications. Migrate by device class, verify manager support, test both directions, and retain rollback.
Read the playbook