Treat a Tailscale tag as a workload identity, not a label on an employee laptop
Tagging changes device identity and can keep a device present after its former user leaves.
Read the guideDSE security knowledge hubCybersecurity
Cybersecurity
Knowledge
Page 5 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Cybersecurity knowledge center
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
DSE post stream
1,658 articlesCybersecurity
Choose authority and waiting time for Bitwarden emergency access
Agree who may request emergency vault access, what they receive, and how long approval can wait.
Read the guide
Limit GitLab deployment credentials to registry pulls
Use the registry-read scope when a deployment system only needs to download container images.
Read the guide
Distribute Caddy local CA trust to the clients that need it
Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.
Read the guide
Grant Docker Compose secrets only to services that need them
Review both the secret definition and each consuming service when replacing environment-based credentials in Linux containers.
Read the guide
Separate an OpenSSH SFTP jail root from its upload directory
Check ownership of the whole chroot path before changing upload permissions for an SFTP account.
Read the guide
Keep declared service state writable under ProtectSystem=strict
Identify the service’s real write locations before weakening a systemd filesystem restriction.
Read the guide
Constrain Google Workspace SMTP relay for device alerts
Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.
Read the guide
Check Firefox enterprise root trust before replacing a certificate
Check operating-system trust and enterprise policy when Firefox alone rejects an internal service certificate.
Read the guide
Review both directions of a WireGuard AllowedIPs change
Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.
Read the guide