06 / Harden
Security Engineering
Strengthen identities, endpoints, networks, and cloud infrastructure with practical safeguards.
Turn recommendations into working safeguards.
Good engineering closes the distance between a finding and a fix. We help improve the configurations, access controls, and architecture that shape your day-to-day security posture.
That includes helping your team adopt AI tools securely, with attention to sensitive data, access, and oversight.
Select a service area to see the work included.
Control who can sign in, what they can reach, and when they can use administrator privileges. We plan the rollout with your team and document the changes.
Conditional Access and MFA
- Test Conditional Access policies in report-only mode before enforcement. Set access rules around user identity, device health, and business needs.
- Deploy phishing-resistant multi-factor authentication, including FIDO2 security keys and Windows Hello for Business. Plan staff enrollment and lost-device procedures.
- Secure emergency access accounts and apply stronger sign-in requirements to administrators.
Active Directory and privileged access
- Review attack paths with BloodHound and PingCastle. Address exposed accounts and Active Directory Certificate Services misconfigurations.
- Remove stale accounts and excess permissions. Separate administrator roles and use Privileged Identity Management for just-in-time access where supported.
- Manage local administrator passwords with Windows LAPS and strengthen Group Policy security settings.
Build consistent security settings for your Microsoft tenant, workstations, and servers. We review the gaps, apply the agreed changes, and document the result.
Microsoft 365 and Entra ID
- Review Secure Score findings and configure the tenant against applicable CIS and Microsoft security baselines.
- Disable legacy authentication, tighten guest access and external sharing, and configure audit logging and retention.
- Configure Defender for Office 365 protections. Review mail forwarding rules and deploy SPF, DKIM, and DMARC to protect your email domain.
Endpoints and servers
- Apply appropriate CIS or DISA STIG baselines for Windows and Linux through Intune, Group Policy, or other management tools.
- Configure BitLocker encryption and recovery key storage, Attack Surface Reduction rules, and application control.
- Strengthen SMB and LDAP settings. Remove outdated protocols, unneeded services, and unnecessary local administrator rights.
Backup and recovery
- Protect backup copies with immutable or offline storage and separate backup infrastructure from the production domain.
- Require MFA on backup consoles and document and test restore procedures.
Limit how a compromised device can move through your network. We design access around the systems your staff, vendors, and departments actually need.
Segmentation and network hardening
- Separate users, servers, management, voice, IoT, and guest traffic. Plan isolation for public safety, dispatch, and operational systems such as water and wastewater.
- Set traffic rules between network segments around documented business needs. Create network diagrams and data flow records.
- Review switches, routers, and wireless access. Secure management access, isolate guests, and identify outdated firmware and end-of-life devices.
Firewalls and remote access
- Remove unused and overly permissive firewall rules. Review both incoming and outgoing traffic controls, logging, and configuration backups.
- Harden VPN access, enforce MFA, and remove internet-exposed Remote Desktop access.
- Give vendors logged, time-limited access. Plan phased Zero Trust Network Access deployments that tie application access to identity and device health.
Make your security tools useful in daily operations. We connect the right information, tune protections, and turn findings into verified fixes.
Logging and detection
- Connect domain controller, firewall, Microsoft 365, and endpoint logs to your security information and event management platform (SIEM).
- Configure Windows audit policies and Sysmon. Build detection rules around your environment and tune endpoint detection and response policies.
Remediation and technical controls
- Prioritize vulnerabilities by exploitability and exposure. Carry out remediation, improve patching processes, and scan again to verify the fixes.
- Implement applicable technical controls for CJIS, CMMC Level 2, NIST SP 800-171, and HIPAA. Collect evidence for audits and assessments.
Review how AI tools access information and fit into your security program. Put clear safeguards around sensitive data, permissions, and oversight.
Data, access, and oversight
- Review AI tool access to company data and connected systems.
- Identify where sensitive information needs stronger access or sharing controls.
- Document safeguards and responsibilities for approved AI use.