One machine at a time, and the ones you cannot touch
Hardening is the least glamorous part of security and the only part that changes what a machine can actually do. These essays are about configuration as a physical property of a running system: why a baseline stops being true the moment it is signed off, why a default outperforms a documented instruction every time, and what to do about the substantial population of hosts that a contract, a warranty or a soldered image forbids you from changing at all.
All essays
- Hosts You Are Not Allowed to Touch
Every hardening programme meets machines where the answer to "apply the baseline" is a structural no. Appliances, embedded controllers, vendor-managed boxes and certified systems each refuse for a different reason, and the remedies are not technical.
- The Default Is the Policy
A secure default and a documented instruction can appear as the same line in a standard, but they have opposite economics. One is paid for once; the other is paid for on every machine, by every person, forever.
- Drift Is Not a Discipline Problem
A hardened machine stops matching its baseline for reasons that have nothing to do with carelessness. The mechanisms are ordinary, deterministic and worth naming, because they decide whether measuring compliance tells you anything at all.