Most incidents do not come from a lack of tools but from permissions somebody granted long ago and forgot about. This area covers the fundamentals that work regardless of budget: a tiering model for privileged accounts, reducing the attack surface, patching, and configuration hygiene.
A SQL Server service account with a password that never expires and that several people know stays unchanged for years, because changing the password means downtime on every server. How to deploy a group managed service account (gMSA): the KDS root key, the account, installation on the servers and the account change in SQL Server Configuration Manager.
Windows authentication in SQL Server keeps working when Kerberos fails, because the client silently falls back to NTLM. How the client builds the SPN, why a named instance needs a static port and its own DNS name, and how to check which protocol applications actually use.
A login lets a connection into the instance, a user grants access to a database, and the two are linked by a SID, not by name. How to build access from directory groups and custom roles, why an application should sign in with a Windows account, and how to fix a user without a login after restoring a database on another server.
Forced password changes every 90 days and “upper case, digit, special character” rules are advice the standards have abandoned. What replaced them, how to check your current domain settings, and which MFA methods resist phishing.
A VPN account for a vendor gives them access to the whole network, with no record of what they did, and often for years after the contract ends. A gateway with session recording, time-limited Active Directory accounts and MFA restrict access to specific machines and a specific time window.
The more everything depends on one sign-in point, the more you need access that does not. Cloud-only accounts with FIDO2 keys, a directory account with a split password, an alert on every use and a quarterly test.
A CI system, a GitOps platform, monitoring and a wiki can all sign users in with a domain account. Direct LDAPS and OIDC through a broker such as Dex or Keycloak give the user the same result and security a completely different one.
The same local administrator password on every workstation built from one image is an open road from the first infected machine to all the others. Windows LAPS fixes this with no extra licences, and a few queries show whether protection covers the whole fleet.
Passwords in playbooks, tokens in pipeline variables, Secrets created by hand in the cluster. How a small team can move secrets into one source and deliver them to consumers without storing values in the repository.
Without any network policy, every pod in the cluster can connect to every other pod. How to introduce default deny per namespace, allow DNS, traffic from the ingress controller and to the database, and not take the applications down in the process.
A certificate’s expiry date is known from the day it is issued, and yet expired certificates keep stopping services. How to build an inventory from three sources, read the dates with commands and set alert thresholds matched to the renewal method.
A single flat network is simple until the first incident. A zone plan with example subnets, a matrix of allowed flows and a test showing that management ports cannot be reached from workstations or the guest network.
A directory nobody tidies collects accounts of people who have left, computers that no longer exist and permissions granted for a moment several years ago. The queries that reveal them, and a removal procedure that can be undone.
A domain administrator who logs on to a workstation leaves the key to the whole directory behind on it. Three tiers, separate accounts and a few user rights in Group Policy close that path without extra software.
A strict policy published in one day ends with your own invoices and notifications being rejected. The rollout stages with ready-made DNS records, DKIM configuration in Exchange Online and commands to verify each step.
A message caught by a filter does not always generate a notification. Whether the user ever finds out, and whether they can release it, depends on the quarantine policy assigned to the mechanism that caught it.