Page 25 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Find public-facing assets, confirm why each exposure exists, remove what is unnecessary, protect what must remain, and repeat the assessment as the environment changes.
Read the checklist
Conditional Access can combine identity, device, application, and location signals to enforce access controls. Report-only evaluation, emergency access, test users, licensing checks, and phased activation are essential to avoid unintended lockout.
Read the playbook
SharePoint and OneDrive sharing is governed by tenant, site, link, group, and Microsoft Entra settings. A safer model uses intentional collaboration sites, authenticated guests where practical, restrictive defaults, ownership, and recurring access review.
Read the guide
Offboarding is an identity, device, records, and continuity workflow. Blocking sign-in is urgent, while mailbox, OneDrive, ownership, legal hold, forwarding, licensing, and account deletion decisions must follow an approved sequence.
Read the checklist
Microsoft 365 Copilot works within a user's existing permissions. That boundary does not correct excessive access: content already visible to a user may become easier to discover, so SharePoint, OneDrive, Teams, ownership, labels, and sharing need review first.
Read the guide
A defensible wireless network needs documented design, secure commissioning, routine monitoring, controlled change, and complete retirement—not just a strong setting on installation day.
Read the guide
Firewall rules stay trustworthy when requests, approvals, tests, owners, expiration conditions, reviews, and removals are part of one documented lifecycle.
Read the checklist
When ransomware or destructive encryption is suspected, activate the incident plan, isolate affected systems in a coordinated way, preserve evidence, use known-safe communications, protect identities and backups, and involve qualified responders before rebuilding.
Read the checklist
SPF, DKIM, and DMARC work together to authenticate sending infrastructure and align it with the address recipients see. A staged rollout helps protect a domain from spoofing without unexpectedly rejecting legitimate business mail.
Read the guide
Microsoft security baselines provide a well-tested starting configuration for supported Windows and Microsoft products. They still require version matching, conflict analysis, application testing, documented exceptions, and phased deployment.
Read the guide