https://securingmachines.com/ Essays on hardening individual machines: configuration baselines and the mechanics of drift, secure defaults versus documented guidance, and the hosts that cannot be hardened — appliances, embedded systems and vendor-managed boxes. en https://securingmachines.com/hosts-you-are-not-allowed-to-touch/ https://securingmachines.com/hosts-you-are-not-allowed-to-touch/ Wed, 22 Jul 2026 00:00:00 +0000 Constraints Every hardening programme meets machines where the answer to "apply the baseline" is a structural no. Appliances, embedded controllers, vendor-managed boxes and certified systems each refuse for a different reason, and the remedies are not technical. https://securingmachines.com/the-default-is-the-policy/ https://securingmachines.com/the-default-is-the-policy/ Wed, 01 Jul 2026 00:00:00 +0000 Defaults A secure default and a documented instruction can appear as the same line in a standard, but they have opposite economics. One is paid for once; the other is paid for on every machine, by every person, forever. https://securingmachines.com/drift-is-not-a-discipline-problem/ https://securingmachines.com/drift-is-not-a-discipline-problem/ Thu, 11 Jun 2026 00:00:00 +0000 Baselines A hardened machine stops matching its baseline for reasons that have nothing to do with carelessness. The mechanisms are ordinary, deterministic and worth naming, because they decide whether measuring compliance tells you anything at all.