Services & consulting

Zero trust architecture

Access decided by identity and posture, never by which network a packet arrived on. Per-device certificates from an internal authority with no trust-on-first-use, mutual TLS between services, an overlay (WireGuard or Headscale) as the only path between sites, and routing and firewall policy that is generated from what a node is entitled to rather than hand-kept. The estate this site runs on is built that way: nodes enrol with a one-time bundle and a pinned root, a node with no firewall policy refuses to serve, and public certificates stop at the public listener while everything behind it trusts only the internal CA. On the consulting side: an AppGate-based zero-trust deployment across 80,000 cloud-managed endpoints. Entitlements — server, port and protocol — were delegated to user groups and backed by the Ardoq enterprise-architecture platform, with iBoss and CrowdStrike alongside; entitlement-gap analysis and application-usage mapping came from Splunk-enriched data.

Built on: cockpit-wireguard (opens in a new tab), cockpit-headscale (opens in a new tab), lin-ad-lab-with-cockpit (opens in a new tab)

Micro-segmentation at the host

Zero trust inside a single subnet, without a network project. Every host carries a ruleset generated from an entitlement catalogue — who may reach what — and delivered by group policy or an agent; entitled traffic passes, everything else is refused at the host and recorded. The switch, the VLAN and the addressing are untouched, which is what makes it deployable across a global Windows Server estate. Planning tooling observes the real flows first, so nothing is cut off from something it was actually using.

Drawn on sheet S-01.

Fleet telemetry and endpoint diagnostics at scale

Self-contained collectors that pull configuration, event and communication data from Windows, network devices, the web gateway (iBoss) and endpoint security (CrowdStrike) into a pipeline that routes, reduces and enriches before the SIEM indexes it — so retention is a decision and not the thing that fails first. Dashboards built for a decision: which network failure point to fix, which entitlement is missing, who owns a system and whether it is patched. Proven at 80,000 managed endpoints on an AppGate-based zero-trust, cloud-managed endpoint deployment, and on ownership, patch and capacity dashboards spanning thousands of Windows systems.

Drawn on sheet S-02.

Storage, replication and continuity architecture

Fibre-channel fabrics that share nothing, arrays in tiers by what the data needs, and the three different kinds of copy — snapshot, replication, backup — that answer three different questions. Two-site designs with journaled replication and rehearsed failover, where recovery point and recovery time are written down as design numbers and then measured; continuity of operations at a third site. A petabyte of file, mail, database, web and virtualisation services has been moved between sites this way.

Drawn on sheet S-03.

Compliance baselines as code

CIS, NIST, PCI DSS and DoD 8500 turned into versioned baseline definitions and delivered by whatever mechanism fits each setting — group policy, MECM/SCCM, an API or a script — then closed as a loop: drift measured from the fleet on a cycle, remediation or a risk acceptance with an owner and an expiry, and audit evidence generated by the loop rather than assembled for it. Patch deployment (MECM, WSUS, Tanium) rides the same loop. Fifteen years of compliance frameworks, operated rather than filed.

Drawn on sheet S-05.

Mass migration and link remapping

Namespace and storage moves where every link is resolved and every embedded reference found before anything moves — including references inside Office documents, Visio drawings, Goldfire knowledge bases and Access databases (tables, forms, macros, VBA) — then waves, each with a rollback written first and a gate passed by verification. Drawn from a domain-integrated DFS mitigation across global storage: 100,000-plus links analysed and 139,000 references updated by tooling built for it in scripted languages over Splunk-enriched data sources and custom dashboards, with server teams led through each wave with minimal disruption.

Drawn on sheet S-04.

Cybersecurity engineering and operations

Twenty-five years of defending Windows and Linux estates, applied to the unglamorous parts: hardening baselines and privileged-access design, secrets management that keeps keys off shared paths, replication of trust material with revocation that actually propagates, security-event capture that reaches a SOC pipeline instead of a local log, and incident-style reviews that write down what was verified, what was refused and what an attacker could still do. Assessments, remediation plans and the engineering to carry them out.

Built on: cockpit-secrets (opens in a new tab), cockpit-os-tuner (opens in a new tab), linux-cockpit-remote-desktop-guac (opens in a new tab)

Linux host management tooling

Cockpit is a good console and a better platform. I build plugins for it that read first and write only where writing is justified — no build step, no bundler, no CDN, and a documented install-versus-deploy separation so a development checkout and a production install are never confused for one another.

Built on: cockpit-os-tuner (opens in a new tab), cockpit-secrets (opens in a new tab), cockpit-wireguard (opens in a new tab)

Remote access: WireGuard, Headscale, RDP

Tunnel and mesh design, routing and NAT policy, client provisioning, and control-plane operation for headscale tailnets — plus browser-delivered remote desktop into Linux hosts that does not put a broker on a public port.

Built on: cockpit-wireguard (opens in a new tab), cockpit-headscale (opens in a new tab), linux-cockpit-remote-desktop-guac (opens in a new tab)

Active Directory, identity and PKI

Directory design and rehearsal on disposable labs: multi-controller domains, group policy, sites and services, FSMO and replication, DNS, and Kerberos-backed authentication for Linux members. Alongside it, an internal certificate authority and the issuance, renewal and trust distribution that make it usable. And directory hygiene at enterprise scale: automated computer placement so policy lands where it should, offboarding audits that find the accounts of leavers still enabled, and group membership synchronised from the HR system so the directory stops disagreeing with payroll.

Built on: lin-ad-lab-with-cockpit (opens in a new tab)

Network services: proxy, DNS, DHCP, firewall

Reverse proxying and load balancing with TLS termination, split internal and external DNS, DHCP and address management, firewall policy, and the replication that keeps a fleet of nodes agreeing with each other. This site is served through exactly that stack.

Automation and reporting

PowerShell and Python automation for people who have to operate the result: modules rather than scripts, reports that render themselves, service and port monitoring, and unattended operating-system deployment for Windows and Linux, run from a deployment automation enclave: DHCP, DNS, iPXE and TFTP stay inside it, and what crosses a network boundary is a customised image over HTTPS.

Built on: MGMT (opens in a new tab), PS_Port_Monitor (opens in a new tab), HtmlReport (opens in a new tab)

Security review of administrative tooling

A second pair of eyes on the consoles that hold your keys: threat model, hazard register, and an adversarial pass over the privileged surface — who the server believes you are, what a client-side check is really worth, and what remains true of an attacker on a good day. The findings are written down, including the ones left standing and why.

Built on: cockpit-secrets (opens in a new tab)