Engagements, one week at a time

The week lands: A working overlay between two of your sites with per-device certificates from an internal CA (no trust-on-first-use), mutual TLS between the first pair of services, and routing and firewall policy generated from entitlement rather than hand-kept. You keep the CA, the policy source and the runbook.

Highest leverage per week: it is the control every other control depends on, and the estate this site runs on already works this way.

Done before: as advanced solutions consultant on an AppGate-based zero-trust deployment across 80,000 cloud-managed endpoints, where entitlements — server, port and protocol — were delegated to user groups and backed by the Ardoq enterprise-architecture platform, with iBoss and CrowdStrike alongside; entitlement-gap analysis and application-usage mapping came from Splunk-enriched data. Separately, host-firewall micro-segmentation delivered through group policy across a global estate.

Built on: cockpit-wireguard (opens in a new tab), cockpit-headscale (opens in a new tab)

The week lands: The inventory read honestly — what moves easily, with effort, or should not move — and a small replacement platform stood up for real with one representative workload on it. Second week: the wave plan with rollback defined before each cutover.

The licensing clock is running for most estates; a week that finds the surprises while they are cheap pays for itself.

Done before: VMware ESX designed and run at architect level — HA, DRS, vMotion and storage vMotion, IOPS balanced across tiers — plus SQL, file and web server migrations.

The week lands: Sign-in delegated from your first three applications to one identity tier: a configurable chain of factors, single-use result redemption, one place to revoke a session and read the audit trail. Service accounts inventoried and reduced; the ones that remain have an owner, a scope and an expiry.

Every app that keeps its own password table is a breach waiting for a reason. Collapsing them is the fastest reduction of blast radius available.

Done before: directory and group synchronisation driven from the HR system; dynamic groups for sensitive-data isolation; account deployment for non-domain DMZ servers worked out with the IAM team.

The week lands: Split internal and external DNS with replication between nodes, DHCP and address management with a ledger of who has what, and a reverse proxy with automated public certificates at the edge — the same stack this site is served through. Existing IPAM data migrated in, whatever product it lives in today.

The record of record for the network is usually a spreadsheet and three people. Making it a service that agrees with itself removes a whole class of outage.

Done before: redundant DHCP reservation planning for a NAC programme; DNS, DHCP and directory for 17 bases and 500 core servers; Splunk queries that exposed incomplete firewall-rule rollouts holding up overseas deployments.

The week lands: Connection metadata captured at the load balancer and on the hosts — who talks to whom, on which port, from which process — landed in your SOC pipeline with dashboards that show ownership, application and capacity on one screen. Built to hold at the scale of thousands of systems, with retention that does not starve the database it lives in.

You cannot segment or defend what you cannot see. This is the map the zero trust work is drawn on.

Done before: extensive network analytics on the 80,000-device AppGate zero-trust deployment — SDP flows, packet analysis, iBoss and CrowdStrike data pulled into Splunk-enriched data sources and custom dashboards that walk network engineers to the failure point; the same data drove the DFS data-path migration mitigation across Goldfire, Office documents and Access databases.

Built on: PS_Port_Monitor (opens in a new tab)

The week lands: Security-event capture wired to an event pipeline: log tailing with named-group extraction, correlation rules, and jobs or webhooks that block, isolate or page. Firewall policy as data — profiles, rule groups and a test gate before anything is applied — so a response is a policy change, not a hand-typed rule.

Detection without a response loop is a dashboard. The week closes the loop and puts the rules under test.

Done before: Windows-firewall micro-segmentation via GPO across a global estate; TLS remediation of misconfigured processes found through MECM/SCCM and SQL reporting; InfoSec processes reshaped for automation and faster response.

Built on: cockpit-secrets (opens in a new tab)

The week lands: Unattended Windows and Linux deployment run from an enclave: DHCP, DNS, iPXE and TFTP inside it and never on the internet; images customised per deployment and delivered over HTTPS. UEFI Secure Boot, TPM and answer files handled — the chain that survives being loaded as a UEFI boot program.

The fastest way to make a fleet reproducible is to make its first boot reproducible.

Done before: hundreds of server builds delivered in a single year; SCADA / FactoryTalk control infrastructure deployed remotely with security and maintenance designed in.

The week lands: A threat model and hazard register for the consoles that hold your keys, then an adversarial pass over the privileged surface — who the server believes you are, what a client-side check is really worth. Findings written down, including the ones left standing and why.

Admin tooling is where a single bug is a full compromise, and it is reviewed least.

Done before: design leadership and code review across a group maintaining hundreds of PowerShell modules; service-account credential handling under AES-256 to meet security requirements.

Built on: cockpit-secrets (opens in a new tab)

The week lands: Dashboards and reports for the people who have to operate the result: server ownership, project team, patch state, related application and load-balancer URL, capacity and network configuration — generated from what the systems say about themselves, not from a spreadsheet.

Proven at the scale of thousands of Windows systems; the week adapts the model to your estate.

Done before: Splunk dashboards tracking configuration, application assignments, capacity and network communications for thousands of systems; Splunk's ROI won by making dropped packets and account lockouts findable in minutes.

Built on: HtmlReport (opens in a new tab), MGMT (opens in a new tab)

The week lands: Backup proven by an actual restore of a representative system, recovery of an offline Windows host without its password, and capacity, CMDB, networking, InfoSec and operational-readiness requirements turned into a checklist a delivery is measured against — the discipline used to deliver three hundred-plus servers for merger close-outs.

A backup that has never been restored is a hope. When the deadline is contractual, the value is in the gates, not the heroics.

Done before: array replication to an off-site continuity location; five SANs totalling 900 TB run and migrated; disaster-recovery fail-over servers engineered and exercised; backup suites stood up with dedup, archive and legal retention.

The week lands: One subnet chosen with you, its real flows observed for the week, an entitlement catalogue drafted from them, and per-host rulesets generated and deployed in audit mode — logging what WOULD be refused, refusing nothing yet. You leave with the catalogue, the generator, and the evidence to switch to enforce.

Segmentation projects die on the network re-design. Doing it at the host inside the subnet you already have removes that project entirely.

The week lands: Self-contained collectors for Windows configuration, events and communications, a pipeline that routes and reduces before your SIEM indexes, and the first three dashboards built for a decision — failure points, entitlement gaps, ownership and patch state. Sized for your fleet, with retention decided on paper before the first byte lands.

Diagnosis that depends on what the user remembers does not scale past a few hundred machines; at 80,000 — the AppGate-based zero-trust, cloud-managed endpoint deployment — it has to already be on the dashboard.

The week lands: Recovery point and recovery time agreed and written down per service, backup proven by an actual restore, replication and consistency groups verified, and one failover rehearsed both ways with the runbook the operators will use. The exit is a table of services with the number promised and the number measured.

Most continuity plans have never been run. A week that runs one turns a document into a capability.

The week lands: An audit of every enabled account against the HR feed to find the leavers still enabled, automated computer placement so policy lands where it should, and group membership synchronised from the HR system for the first three groups that matter — with the offboarding workflow fixed so it does not drift back.

The commonest breach path is an account that should not exist. Finding them is cheap; the week makes sure they stay found.

Built on: lin-ad-lab-with-cockpit (opens in a new tab)

The week lands: One framework (CIS, NIST, PCI DSS or DoD 8500) turned into versioned baseline definitions, delivered by group policy, MECM/SCCM or API as each setting needs, and a drift dashboard that measures the fleet against it on a cycle. Exceptions become risk acceptances with an owner and an expiry. The audit evidence generates itself from then on.

A compliance figure that is asserted rather than measured is the one an auditor will not accept and an attacker will not respect.