Ops Log topic
Security & Infrastructure field notes
Reviewed Security & Infrastructure field notes by Michal Jatczak. Each public note includes its evidence, test context and a check you can run.
33 reviewed notes
A 47-point offboarding checklist and the three tiers that decide how fast to run it
A 47-point leaver checklist derived from ISO/IEC 27001:2022 Annex A control text and current vendor documentation, with three escalation tiers, a runnable Microsoft Graph identity block, and the token-lifetime arithmetic that decides when revocation has actually landed.
DORA in practice: the three report clocks, the major-incident gate, and the evidence pack
DORA has been enforceable since 17 January 2025, and under Article 5 of Commission Delegated Regulation (EU) 2025/301 each of the three reports on a major incident runs from a different event. This memo rebuilds the deadlines against that article, ships a PowerShell function that computes them, separates the Article 35 penalty on critical third-party providers from the Article 50 regime that applies to financial entities, and lists the evidence the regulation requires you to hold.
Eight Azure cost levers, and how to size each one on your own bill
Eight Azure cost levers with the formula for each, so the figure comes from your own consumption data rather than someone else's case study: an inventory script, the Advisor thresholds that actually apply, the retention and rehydration penalties on blob tiering, what a Basic log plan costs in detection capability, and a rollback order ranked by reversibility.
Fifteen Microsoft 365 tenant settings that need an explicit decision
Fifteen tenant-wide Microsoft 365 controls, each with the licence tier it actually needs, a read-only Graph, Exchange and SharePoint audit script, the side effects to plan for, and the rollback path. Six pieces of pre-2024 guidance in this area are corrected, five of them attached to numbered rows.
NIS2 for managed service providers: who is actually in scope, and what Article 21 requires
A clause-by-clause scoping runbook for managed service providers under Directive (EU) 2022/2555: the size test that lives in the SME Recommendation, the closed Article 2(2) list that does not name MSPs, the Article 21(2) control set as expanded by Implementing Regulation (EU) 2024/2690, and the Article 23 reporting clock with the MSP-specific significance thresholds.
Backup after 3-2-1: immutability modes, drill cadence, and the evidence an auditor accepts
3-2-1 describes the shape of a backup estate but says nothing about its blast radius. This memo settles four decisions: compliance-mode retention over governance mode, two retention tiers sized separately, a second party on destructive operations, and a drill that leaves a dated artefact behind.
Running Prometheus, Loki and Alertmanager on one VM: configuration, retention and cost
A single-VM Prometheus, Loki, Alertmanager and Grafana deployment that starts on the first attempt: the retention flags that belong on the command line, the disk-sizing formula that decides the machine class, alert rules with the false-page guards in place, and a cost model built from published list prices instead of asserted savings.
Conditional Access: a ten-policy baseline and the order to deploy it in
Ten Conditional Access policies, the Microsoft Learn control behind each one, the report-only order that surfaces breakage before a user hits it, and an emergency-access design that survives the mandatory MFA enforcement on the Microsoft admin portals.
Network segmentation for a 100 to 500 seat office: VLANs, policy as code and the identity overlay
A cutover runbook for turning a flat office LAN into purpose-based zones: the VLAN scheme, the 802.1X and RADIUS layer that actually places a device into a zone, firewall policy held in version control, host-level nftables, and an independent rollback path for every stage.