Technology in Cybersecurity: Cert, Tenure, or Craft?
In cybersecurity hiring, two signals mislead us. A certificate proves someone studied, and tenure proves they showed up for years. Neither proves craft, the skill to apply the work when an incident goes off-script.
Conditional Access Exclusions: A Hygiene Guide for IT Managers
A Conditional Access exclusion is any user, group, role, or app you leave out of a policy, so that policy’s control doesn’t apply to them.
Conditional Access, Read Right: The If-Then Engine at Your Front Door
Conditional Access is Microsoft Entra’s policy engine for sign-in decisions. It gathers signals about a sign-in, who it is, what app, what device, where from, how risky, then matches them against your rules and enforces…
The Call No Owner Wants to Get
Picture it. It’s a Tuesday. A good client is on the line and their voice is a little off. “Quick question. Why did your bank details change on the last invoice?” You didn’t change anything. That’s the moment it lands.
You Don’t Need to Manage the Phone. You Need to Manage the Data.
For personal phones, Mobile Application Management protects corporate data inside approved apps without enrolling the entire device. Full MDM fits company-owned devices.
Eligible, Not Active: Why PIM-Enabled Groups Are the Right Way to Hold a Role
PIM-enabled groups should make users eligible, not permanently active. Activation should be time-limited, logged, and monitored for direct additions that bypass PIM.
Did You Really Secure LDAP – or Just One-Third of It? (Part 1 of 6)
LDAP security is three separate jobs: encrypt the connection, strengthen the authentication method, and secure the account. Enabling LDAPS completes only the first job.
Is Your Domain Controller Leaking Passwords? (Part 2 of 6)
Cleartext or unsigned LDAP simple binds expose reusable passwords. Event IDs 2887 and 2889 identify the affected volume, clients, and accounts before enforcement.
Is Your “Encrypted” LDAP Actually Protected? (Part 3 of 6)
LDAPS and StartTLS can protect LDAP traffic equally when correctly enforced. Protection fails when StartTLS falls back to cleartext or weak TLS remains enabled.
Why Send a Password You Can’t Take Back? (Part 4 of 6)
SASL with Kerberos replaces a reusable LDAP password with a short-lived ticket. Signing and channel binding then protect that authentication from tampering and relay.
Conditional Access Break-Glass Accounts: Would Yours Still Get You In?
Conditional Access break-glass accounts can quietly stop working as Microsoft changes the...
