Ops Log tag
#Security
Reviewed Ops Log notes tagged Security, written by Michal Jatczak with source links, test context and operational checks.
17 reviewed notes
An incident-response playbook for a team without a security operations centre
A first-hours runbook for a 4 to 15 person technical team on Microsoft 365: the three EU reporting clocks and the event that actually starts each one, a containment sequence that captures evidence before it cuts access, and the documented side effects and rollback for every high-blast-radius action.
A 47-point offboarding checklist and the three tiers that decide how fast to run it
A 47-point leaver checklist derived from ISO/IEC 27001:2022 Annex A control text and current vendor documentation, with three escalation tiers, a runnable Microsoft Graph identity block, and the token-lifetime arithmetic that decides when revocation has actually landed.
DORA in practice: the three report clocks, the major-incident gate, and the evidence pack
DORA has been enforceable since 17 January 2025, and under Article 5 of Commission Delegated Regulation (EU) 2025/301 each of the three reports on a major incident runs from a different event. This memo rebuilds the deadlines against that article, ships a PowerShell function that computes them, separates the Article 35 penalty on critical third-party providers from the Article 50 regime that applies to financial entities, and lists the evidence the regulation requires you to hold.
Fifteen Microsoft 365 tenant settings that need an explicit decision
Fifteen tenant-wide Microsoft 365 controls, each with the licence tier it actually needs, a read-only Graph, Exchange and SharePoint audit script, the side effects to plan for, and the rollback path. Six pieces of pre-2024 guidance in this area are corrected, five of them attached to numbered rows.
Conditional Access: a ten-policy baseline and the order to deploy it in
Ten Conditional Access policies, the Microsoft Learn control behind each one, the report-only order that surfaces breakage before a user hits it, and an emergency-access design that survives the mandatory MFA enforcement on the Microsoft admin portals.