IT & security playbooks

Deep operational guidance for the people who set policy and run systems.

Password policy & IAM

800-63B policy, RBAC, least privilege, joiner-mover-leaver.

A modern password policy that follows NIST SP 800-63B
Length over complexity, no forced rotation, breach screening, and rate-limiting. The evidence-based policy that replaces the composition rules everyone still copies from 2005.
RBAC, least privilege, and joiner-mover-leaver
Access is a lifecycle, not a one-time grant. How to design roles, enforce least privilege, wrap privileged access in PAM, and make deprovisioning automatic rather than aspirational.

MFA at scale

Rolling out phishing-resistant MFA across an org.

Deploying phishing-resistant MFA across the org
Not all MFA is equal. How to roll out FIDO2 / WebAuthn and passkeys at scale, rank your factors by real-world strength, handle enrollment and recovery, and retire SMS.

Password manager deployment

Choosing and rolling out an enterprise vault.

Choosing and deploying an enterprise password manager
Selection criteria, architecture, rollout, and the governance that turns a vault from a personal convenience into a managed control, including secrets for machines, not just people.

Email authentication

SPF, DKIM, and DMARC with alignment.

Email authentication: SPF, DKIM, and DMARC with alignment
How the three records fit together, why alignment is the part that actually stops spoofing, and a staged path to an enforcing DMARC policy without breaking legitimate mail.

MDM & endpoint

Baseline device management and hardening.

MDM and endpoint hardening: a baseline
The device-side controls that make identity and MFA trustworthy: enrollment, disk encryption, patch enforcement, configuration baselines, compliance-gated access, and remote wipe.

PKI & certificates

Certificate management and PQC readiness.

Certificate management and PQC readiness
An operational PKI you can actually reason about: inventory, automated issuance and renewal, short lifetimes, and building the crypto-agility that a post-quantum transition will demand.

Key management

KMS/HSM practice and crypto-agility operations.

Key management with KMS and HSM, built for agility
The lifecycle of a cryptographic key (generation, storage, rotation, revocation, destruction) done with KMS and HSMs, and architected so algorithms can change without rewrites.

Monitoring & enforcement

Detecting, auditing, and enforcing policy.

Monitoring and enforcing identity policy
Policy on paper is not a control. How to detect credential attacks, audit access continuously, and enforce configuration automatically so drift and abuse surface fast.

Credential-compromise response

Containing account takeover the right way.

Containing account takeover the right way
Resetting the password is not enough: attackers persist through sessions, tokens, app passwords, and MFA methods. The full containment playbook for a compromised credential.

Policy templates

Adaptable policy and rollout checklists.

Identity policy templates and rollout checklists
Adaptable starting points (a password and authentication policy outline, an access-management policy, and a phased rollout checklist) grounded in the standards, ready to tailor.