Holding the Line: Practical IT Security

SECURITIES
  • 0.0 (0)
  • Management
  • Weekly

Enhance your security knowledge with us.

  1. 12h ago

    The Hardened Stack — Ep. 14: Incident Response Playbooks

    Welcome to Episode 14 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.A board-approved incident response plan is a good intention, but an IT team staring at a live breach at 7:52 on a Tuesday morning needs concrete runbooks—written procedures that tell you exactly what to type before panic takes over. In Chapter 14: Incident Response Playbooks, we explore how small IT teams can run disciplined incident response without an enterprise SOC. We break down the adapted NIST lifecycle, practical severity classification (SEV-1 to SEV-4), how to contain an account without destroying digital forensics, and step-by-step playbooks for the four most common security incidents: phishing reports, compromised accounts, ransomware, and lost devices.What You’ll Learn in This Episode The Incident Lifecycle: Why skipping phases under pressure turns small problems into disasters, and how to work the sequence: Prepare, Detect, Triage, Contain, Eradicate, Recover, and Learn.Triage Before Action: Avoiding the instinct to frantically wipe servers or pull plugs, which destroys the evidence needed to see if an intruder reached other systems.Severity Classification (SEV-1 to SEV-4): Establishing an objective scale where severity is raised quietly by anyone who spots spread, but lowered loudly only with a second opinion.The First-15-Minutes Triage Runbook: Pulling sign-in logs, checking for rogue inbox rules (e.g., hidden forwarding to RSS folders), auditing OAuth app grants, and mapping permissions before acting [522–524].Safe Account Containment: Why disabling sign-in alone fails against stolen refresh tokens, how to revoke all active sessions simultaneously, and guarding containment scripts so you never accidentally lock out your own break-glass accounts [526–529].Evidence Preservation ("Capture Before You Change"): Exporting mailbox rules, taking screenshots, grabbing hashes, and preserving logs in central storage before executing remediation steps [531–533].The 4 Essential SMB Playbooks:Out-of-Band Incident Comms & On-Call Reality: Establishing a single source of truth, coordinating over an external channel in case email is compromised, and being honest about what a part-time security team can staff.At Meridian Foods: How service desk lead Lucy Fernández and senior sysadmin Hana Sato triaged eleven sudden invoice-phishing tickets, discovered ten were stopped by FIDO2 keys, and safely contained the single compromised account that had created a hidden payment-forwarding rule.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  2. 1d ago

    The Hardened Stack — Ep. 13: Vulnerability Management

    Welcome to Episode 13 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.Running a vulnerability scan across a corporate network can quickly yield thousands of findings, leaving busy IT teams feeling completely overwhelmed. As security lead Aiko Tanaka reminds junior admin Ben Carter when a scan returns over 11,000 issues: "We don't have eleven thousand vulnerabilities—we have a scanner that found eleven thousand things... our job is to find the thirty that actually matter." In Chapter 13: Vulnerability Management, we examine how to turn raw scan data into an actionable, prioritized remediation plan. We explore deep authenticated scanning, why relying on CVSS scores alone is a dangerous trap, how to leverage real-world exploitation signals like EPSS and the CISA KEV catalog, and how to establish risk-based patch SLAs and verified remediation loops.What You’ll Learn in This Episode Finding Flaws (Authenticated vs. Unauthenticated Scans): Why unauthenticated external scans only see the outer surface, and why authenticated internal scans are essential to inspect installed package versions and missing patches.Guarding Scanner Credentials: Storing scanner credentials in a central vault, scoping them to read-only access, and auditing their use like any other privileged identity.Why CVSS Alone Fails: Understanding why a theoretical CVSS 9.8 vulnerability on an isolated internal server is often less urgent than a CVSS 7.5 flaw that attackers are actively exploiting on an internet-facing host.Leveraging EPSS & The CISA KEV Catalog: Using the Exploit Prediction Scoring System (EPSS) to measure exploitation likelihood, and using CISA's Known Exploited Vulnerabilities (KEV) list to immediately escalate flaws confirmed to be under active attack in the wild.Context-Aware Risk Weighting: Joining vulnerability scan data with your asset inventory (internet exposure, data classification tiers) to derive an estate-specific risk rank.Risk-Based Patch SLAs & Emergency Process: Setting clear timelines (such as fixing active KEV flaws within 24–72 hours), establishing an out-of-band emergency change path, and applying compensating controls when immediate patching isn't possible.Formal, Time-Boxed Exceptions: Documenting accepted risks with named business owners, compensating controls, and mandatory review dates so unpatched flaws never quietly evaporate.Verification & Honest Metrics: Why a finding is only closed when a follow-up scan confirms it gone, and why tracking time-to-remediate (MTTR) and open KEV age is far more effective than reporting raw finding counts.At Meridian Foods: How a VPN appliance flaw jumped to the top of Meridian's daily queue the moment it appeared on the CISA KEV list, allowing Omar Haddad and Aiko Tanaka to execute an emergency patch within 18 hours.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  3. 1d ago

    The Hardened Stack — Ep. 12: Logging, Monitoring and SIEM

    Welcome to Episode 12 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.You cannot respond to what you cannot see, and you cannot see what you did not log. However, logging everything and watching none of it is almost as useless as logging nothing, because the single signal that matters gets drowned in millions of noisy log lines. In Chapter 12: Logging, Monitoring and SIEM, we explore how to build a reliable "flight recorder" for your IT estate without exhausting a small team. We cover what to log (and what to exclude), how to ship logs to a tamper-resistant central store, how to run a SIEM without drowning in alert fatigue, and how to write three essential high-value detections.What You’ll Learn in This Episode What to Log (And What to Exclude): Prioritizing identity sign-ins, cloud control plane activity, EDR events, email verdicts, and network boundaries while explicitly excluding secrets, passwords, and sensitive customer PII from your log store.Centralizing & Protecting the Record: Why logs must ship off local hosts immediately over encrypted TLS to an append-only, central destination that an attacker cannot quietly alter or erase.SIEM Without Drowning: Moving away from default rule clutter toward a small set of high-confidence detections, separating "alert a human now" from "record for later investigation," and tuning out noise so alert channels remain trusted.3 High-Value Detections That Earn Their Place:Monitoring the Monitoring: Tracking log-source health and treating a silent log source as an active security finding.At Meridian Foods: How network engineer Omar Haddad caught a suspicious 06:40 Sunday sign-in from Lagos on Hana Sato's account using an impossible-travel rule, and how security lead Aiko Tanaka and Dev Okonkwo tuned Sentinel alerts down from 50 noisy notifications per day to 3–4 actionable signals.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  4. 1d ago

    The Hardened Stack — Ep. 11: Data Protection and Backup

    Welcome to Episode 11 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.As security lead Aiko Tanaka keeps pinned above her desk: "A backup you have never restored is a hope, not a backup". Most IT teams rely on nightly backup jobs that report "success," yet have never actually proven they can restore data under pressure. To make matters worse, modern ransomware specifically hunts and destroys backup servers and storage credentials before triggering encryption. In Chapter 11: Data Protection and Backup, we explore how to make data survivable against both hardware accidents and hostile ransomware attacks. We cover data classification, encryption at rest and in transit, proportional Data Loss Prevention (DLP), the modern 3-2-1-1-0 rule, compliance-mode immutable backups, and setting up isolated restore drills.What You’ll Learn in This Episode Classify Before You Protect: Why you cannot protect everything equally, and how establishing a 4-level classification scheme (Public, Internal, Confidential, Restricted) automatically drives encryption, access controls, and backup tiers based on business value.Encryption at Rest & In Transit: Enforcing TLS 1.2+ for all moving traffic—including internal east-west network flows—and securing data at rest using full-disk encryption and customer-managed keys (CMK).Proportional Data Loss Prevention (DLP): Why DLP should start in audit-and-notify mode for high-risk data patterns (like credit cards or PII) so false positives are tuned out before enforcing blocks on daily work.The Ransomware-Era 3-2-1-1-0 Rule: Upgrading traditional backup guidelines to survive active backup destruction:Compliance-Mode Immutable Storage: Using object lock in cloud storage to prevent backup deletion or modification for a set retention window—even if an attacker holds stolen domain admin credentials.Separating Backup Credentials: Isolating backup storage identities from everyday administrative accounts so a compromised admin login cannot wipe recovery targets.Testing Restores (The Step Everyone Skips): Why a "successful" backup status report is insufficient, and how to execute quarterly restore tests into isolated sandboxes to measure your true Recovery Time Objective (RTO).At Meridian Foods: How security lead Aiko Tanaka and senior sysadmin Hana Sato ran a drill restoring the 300,000-member customer loyalty database to an isolated sandbox, uncovered a hidden log-backup failure that green checkmarks had missed, and established a verified 40-minute recovery baseline.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  5. 1d ago

    The Hardened Stack — Ep. 10: Secrets and Key Management

    Welcome to Episode 10 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.A secret—whether an API key, database password, or private TLS key—is a single credential that grants direct access without a second factor. When hardcoded into source code, configuration files, or build scripts, it becomes a ticking time bomb scattered across developer laptops, CI caches, and permanent git commit histories. In Chapter 10: Secrets and Key Management, we explore how to eliminate standing secrets across your infrastructure. We unpack how secret managers work, how to move from static credentials to short-lived workload identity and OIDC federation, how to rotate secrets without downtime, how to manage customer-managed encryption keys, and how to find credentials already committed to your repositories.What You’ll Learn in This Episode Why Hardcoded Secrets Are Time Bombs: Why committing credentials to version control is so dangerous—git history permanently remembers old commits, copying secrets across laptops and build pipelines with zero read audit trail.Secret Managers & Runtime Fetching: Moving secrets into central vaults (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault) so applications fetch values into memory at runtime using platform identities rather than reading local configuration files.Zero-Downtime Secret Rotation: Implementing the two-credential model (dual active logins or keys) to safely rotate database passwords and API tokens on a schedule without causing production outages.Short-Lived Credentials & Workload Identity: Replacing static cloud access keys with platform-managed identities and OpenID Connect (OIDC) federation for CI/CD pipelines (e.g., GitHub Actions), allowing automated builds to assume short-lived roles without storing long-lived keys.Envelope Encryption & Customer-Managed Keys: Understanding how data-encryption keys (DEKs) protect raw data while central key-encryption keys (KEKs) in hardware security modules wrap the DEKs—giving organizations full control and access logging over encryption keys.TLS Certificate Expiry & Independent Monitoring: Automating public certificate issuance via ACME/Let's Encrypt and setting up independent external monitoring scripts (flagging expiration within 21 days) to prevent unexpected service outages.Scour Repositories & The Strict Remediation Sequence: Using tools like gitleaks to scan full git commit histories. Why finding a leaked secret requires a strict 4-step sequence: 1) Rotate the secret immediately, 2) Replace usage with a vault lookup, 3) Purge history if feasible, and 4) Add pre-commit scanning hooks.At Meridian Foods: How cloud engineer Dev Okonkwo scanned Meridian's repositories and uncovered 9 committed secrets—including an 11-month-old database password in a test file left by a former employee—and how the team converted a stressful Saturday maintenance chore into a smooth, weekday automated quarterly rotation.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  6. 1d ago

    The Hardened Stack — Ep. 9: Secure Development and DevSecOps

    Welcome to Episode 9 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.Even if an IT team does not view itself as a software development shop, the automation scripts, infrastructure-as-code files, ordering portals, and internal tools it writes or customizes are all software that can be targeted by attackers. In Chapter 9: Secure Development and DevSecOps, we explore how to build security directly into the software development lifecycle rather than bolting it on at the end. We examine the practice of "shifting left," keeping hardcoded credentials out of code repositories, blunting supply-chain dependency risks, automating CI/CD pipeline scans, enforcing strict branch protection, and maintaining container hygiene.What You’ll Learn in This Episode Shifting Security Left in the SDLC: Why catching a security flaw during coding or design is exponentially cheaper than attempting to remediate an incident in production.3-Question Design Threat Modeling: Asking early what data a feature touches, who should reach it, and what happens if inputs are hostile before writing a single line of code.Secrets Never Belong in Code: Why API keys, database passwords, and connection strings committed to git repositories remain permanently in version history, and why they must be fetched at runtime from secret managers.Managing Supply-Chain & Dependency Risk: Why modern applications consist mostly of third-party open-source libraries, and how generating Software Bills of Materials (SBOMs), using lockfiles, and scanning dependencies blunts supply-chain attacks.Automated CI/CD Pipeline Scanning: Implementing dependency vulnerability scanning, secret scanning (such as Gitleaks or Trivy), and SAST as mandatory build gates that block pull requests with high or critical findings.Code Review & Branch Protection: Enforcing rules on main branches so that no single person or compromised credential can push unreviewed code directly into production.Container & Image Hygiene: Utilizing multi-stage Docker builds, starting from minimal or distroless base images pinned to immutable digests, running processes as non-root users, and scanning container images.At Meridian Foods: How cloud engineer Dev Okonkwo ran a pipeline scanner on the customer loyalty app, discovering a vulnerable parser hidden three layers deep in dependencies and an old SMS API key committed to a test file by a former employee.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  7. 2d ago

    The Hardened Stack — Ep. 8: Email Security

    Welcome to Episode 8 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.Unlike a firewall that can default to denying all incoming traffic, email is designed by definition to accept messages from strangers. This makes email the single most common initial entry point for cyberattacks. In Chapter 8: Email Security, we break down how to secure an open communication channel without breaking business operations. We demystify the core trio of email authentication—SPF, DKIM, and DMARC—and walk step-by-step through a safe, phased DMARC rollout that moves from monitoring to full rejection without accidentally blackholing legitimate company invoices.What You’ll Learn in This Episode The 4 Primary Email Threat Shapes:SPF (Sender Policy Framework): Authorizing specific IP addresses and mail services (spf.protection.outlook.com) via DNS TXT records, avoiding the 10-lookup limit, and publishing v=spf1 -all on unused or parked domains.DKIM (DomainKeys Identified Mail): Adding cryptographic digital signatures to outgoing mail headers via selector DNS records (selector1._domainkey...) to ensure tamper-evident delivery that survives email forwarding.DMARC (Domain-based Message Authentication, Reporting and Conformance): Forcing domain alignment between the visible From header and underlying SPF/DKIM domains, and establishing aggregate feedback loops (rua).The 3-Stage Safe DMARC Rollout:Defender for Office 365 Protections: Enabling click-time link rewriting (Safe Links), attachment sandboxing (Safe Attachments), anti-impersonation protection for key executives, and blocking automatic external email forwarding rules.Turning People into Sensors: Why BEC requires non-technical process controls (such as a mandatory second signatory for payment detail changes) and a one-click, non-punitive reporting button.At Meridian Foods: How network engineer Omar Haddad conducted a smooth 6-week DMARC rollout, and how an alert accounts-payable clerk stopped a convincing fake-CFO invoice request from David Chen by reporting it to service desk lead Lucy Fernández.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

  8. 2d ago

    The Hardened Stack — Ep. 7: Microsoft 365 and Entra ID Security

    Welcome to Episode 7 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.For most small and mid-size organisations, the Microsoft 365 and Entra ID tenant is both the crown jewels and the main control plane. It houses your email, files, chat, calendars, and central identities. In Chapter 7: Microsoft 365 and Entra ID Security, we dive into turning native controls into an active defense. We explore how to treat Microsoft Secure Score as an actionable backlog rather than a vanity metric, build a rock-solid Conditional Access baseline, eliminate legacy authentication protocols, practice strict admin-role hygiene with Privileged Identity Management (PIM), and eliminate the hidden danger of unauthorized OAuth app consent.What You’ll Learn in This Episode Secure Score as a Map, Not a Scoreboard: How to use Secure Score as a prioritized improvement backlog without falling into the trap of chasing points for incomplete controls.Building a Conditional Access Baseline: Structuring single-purpose, version-controlled policies (MFA for all, blocking legacy auth, device compliance) and testing in report-only mode before enforcing.Enforcing Phishing-Resistant MFA: Moving from SMS to app number-matching, and deploying FIDO2 security keys or passkeys to administrators and high-risk roles first.Killing Legacy Authentication: Uncovering hidden legacy sign-ins (IMAP, POP3, SMTP AUTH) that bypass MFA, migrating legitimate services, and enforcing a hard block in Conditional Access and Exchange Online.Admin-Role Hygiene & PIM: Eliminating standing Global Admin privileges, using Privileged Identity Management (PIM) for just-in-time elevation, keeping cloud-only separate admin accounts, and safeguarding monitored break-glass emergency accounts.Taming OAuth App Consent & External Sharing: Setting sensible external sharing defaults, restricting user app consent to low-risk permissions, and requiring admin approval to stop "illicit consent" attacks that bypass MFA.Defender for Office 365 & Purview DLP: Configuring Safe Links and Safe Attachments for click-time protection, and rolling out Data Loss Prevention (DLP) policies in audit mode before enforcing blocks.At Meridian Foods: How sysadmin Hana Sato staged Conditional Access in report-only mode to prevent locking out factory floor ordering terminals, and how cloud engineer Dev Okonkwo discovered and revoked a forgotten "PDF Merge Pro" OAuth app that had standing read access to the CFO's mailbox for 18 months.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell/CLI commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.

See All (30)

About

Enhance your security knowledge with us.

Information