Page 9 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
IPFIX can show who communicated, when, where, and how much—if observation points, templates, clocks, sampling, transport, retention, and collector health are engineered and tested first.
Read the guide
Multicast can reduce duplicate video streams, but missing queriers, uncontrolled flooding, inconsistent IGMP behavior, routing boundaries, or silent failback can turn efficiency into an outage. Engineer and test the entire group path.
Read the playbook
An online camera can still be pointed wrong, obscured, unfocused, reflecting infrared, recording the wrong stream, or producing unusable exports. Audit image purpose, scene, hardware, recording, time, analytics, and evidence workflow together.
Read the checklist
A cardholder export shows what the system grants, not what a person still needs. Have accountable role and area owners affirm required access, challenge exceptions, remove stale grants, and verify the controller received the change.
Read the playbook
A mechanical key can bypass identity, schedules, revocation, alarms, and audit trails. Govern high-impact keys with named ownership, least privilege, controlled issue, inventory, return, loss response, and periodic proof of custody.
Read the playbook
Biometric matching has false matches and false non-matches, while spoofing, environment, enrollment, demographics, privacy, and fallback shape real risk. Pilot the actual population and workflow before treating a biometric as trusted access.
Read the guide
Microsoft Entra authentication context can invoke Conditional Access for a sensitive action inside a capable application. Use it to add risk-appropriate step-up without assuming it protects unsupported paths or replaces baseline access policy.
Read the guide
Microsoft Entra cross-tenant access settings govern inbound and outbound B2B relationships and trust in external MFA or device claims. Inventory real partners, defaults, applications, and lifecycle before broad collaboration becomes the policy.
Read the playbook
Blocking sign-in and revoking refresh tokens are important, but existing access and application sessions can end on different timelines. Run a documented containment workflow and verify effective loss of access across supported services and independent applications.
Read the playbook
Shared mailboxes outlive projects and teams unless someone owns membership, direct sign-in, forwarding, retention, licensing, automation, and closure. Govern each mailbox as a business service, not a permanent bucket of delegated access.
Read the checklist