Occasional writing on infrastructure, operations and the decisions behind them. Published when there is something worth saying — not to a content calendar.
Removing local administrator rights is one of the highest-value security changes available and one of the most frequently abandoned. The projects that fail almost always fail the same way, and it is not a technical problem.
Adam Leveille, CEO & Principal Consultant
Read moreThe published averages are enormous and nearly useless, because they average across organizations nothing like yours. Here is how to calculate a figure for your own business that will survive contact with a finance director.
Adam Leveille, CEO & Principal Consultant
Read moreThe practice is usually explained by software companies, to software companies, with examples from software companies. The underlying idea is more broadly useful than that — and adopting it does not require becoming a development shop.
Adam Leveille, CEO & Principal Consultant
Read moreA marketing site is usually the least critical system an organization runs and the most frequently compromised. That combination — low attention, high exposure — is exactly what makes it the entry point.
Adam Leveille, CEO & Principal Consultant
Read moreMoving to a major cloud platform transfers a great deal of operational risk to the provider. It does not transfer all of it, and the part that stays with you is not the part most organizations assume.
Adam Leveille, CEO & Principal Consultant
Read moreThe commercial terms in an MSP contract are usually straightforward. The operational terms — scope boundaries, exclusions, data ownership and exit — decide whether the relationship works. Here is what to read carefully and what to negotiate.
Adam Leveille, CEO & Principal Consultant
Read moreMulti-factor authentication is the highest-value security control most organizations can deploy. It is also routinely deployed in a form that a competent attacker walks straight through. The difference is worth understanding before you tick the box.
Adam Leveille, CEO & Principal Consultant
Read moreThe vulnerabilities used against mid-sized organizations are rarely novel. They are usually months old, publicly catalogd, and patched by the vendor before the attack. Understanding why the patch did not get applied is more useful than understanding the vulnerability.
Adam Leveille, CEO & Principal Consultant
Read moreAlmost every organization we assess has backups. A much smaller number have ever restored one. The gap between those two facts is where most of the damage in a serious incident actually happens.
Adam Leveille, CEO & Principal Consultant
Read moreAlmost every provider advertises round-the-clock support. Far fewer will tell you who is awake, what they are allowed to do at 3am, and what happens when the answer is "nobody, until Monday". Here is how to read the claim.
Adam Leveille, CEO & Principal Consultant
Read moreMid-market companies lose enterprise deals at the security questionnaire, usually over things that were cheap to fix a year earlier. What reviewers really check, which answers end a deal, and how to be ready before the questionnaire arrives.
Adam Leveille, CEO & Principal Consultant
Read moreMost monitoring degrades into noise within a year. A full account of how we decide what wakes a person, what raises a ticket, what is merely recorded — and the database constraint that stops one flapping disk producing forty tickets overnight.
Caleb Gay, DevOps Consultant
Read moreA complete account of how we move a live system onto new infrastructure: what we check before we start, the order operations have to happen in, the failure modes that cost people their weekend, and the one step we will not automate.
Adam Leveille, CEO & Principal Consultant
Read more
A scoping conversation with a senior engineer. We will tell you what we would change, what it would cost, and whether we are the right firm for it.