MFA That Works Every Time
The registration step most people skip Turning on multi-factor authentication feels like the job is finished. For almost every account, it is.
-
-
The Scapegoat After the Breach
For the security leader who owns the risk Somewhere in your files is a form with your name on it. An insurance application, a customer questionnaire, a board attestation. One line says MFA is enforced.
-
Conditional Access Exclusions: A Hygiene Guide for IT Managers
A Conditional Access exclusion is any user, group, role, or app you leave out of a policy, so that policy’s control doesn’t apply to them.
-
The Call No Owner Wants to Get
Picture it. It’s a Tuesday. A good client is on the line and their voice is a little off. “Quick question. Why did your bank details change on the last invoice?” You didn’t change anything. That’s the moment it lands.
-
Did You Really Secure LDAP – or Just One-Third of It? (Part 1 of 6)
LDAP security is three separate jobs: encrypt the connection, strengthen the authentication method, and secure the account. Enabling LDAPS completes only the first job.
-
Is Your Domain Controller Leaking Passwords? (Part 2 of 6)
Cleartext or unsigned LDAP simple binds expose reusable passwords. Event IDs 2887 and 2889 identify the affected volume, clients, and accounts before enforcement.
-
Why Send a Password You Can’t Take Back? (Part 4 of 6)
SASL with Kerberos replaces a reusable LDAP password with a short-lived ticket. Signing and channel binding then protect that authentication from tampering and relay.
-
When Did That Service Account Last Rotate? (Part 5 of 6)
gMSA and dMSA reduce service-account risk through automatic password management and machine-bound use. They still require protected LDAP transport and least privilege.
-
Are You Hoping Your LDAP Is Secure – or Do You Know? (Part 6 of 6)
A complete LDAP migration starts with auditing, then secures the channel, bind, and account before enforcing signing and channel binding and validating the result.
-
Blocking USB Storage Does Not Block USB Security Keys
A USB storage block targets mass-storage devices. FIDO2 security keys use the Human Interface Device protocol, so they require separate endpoint and Entra ID policy design.
