Cybersecurity Wiki
In-depth articles on cybersecurity topics.
Identity & Access Management
Access Control models: DAC, MAC, RBAC, ABAC and Zero Trust
Access control is the fundamental security concept of any IT system.
Offensive Security
Active Directory Attacks: Kerberoasting, Pass-the-Hash and Golden Ticket
Learn the most common Active Directory attack techniques - Kerberoasting, Pass-the-Hash, Golden Ticket - and how to defend your Windows infrastructure.
Windows Security
Active Directory Domain Controller: Architecture and Hardening
The domain controller is the central authority in Active Directory environments. This article explains architecture, Kerberos, group policies, hardening measures, and attack vectors.
Anwendungssicherheit
API Security: OWASP API Top 10, Authentication and Best Practices
API Security guide: OWASP API Top 10 (2023), authentication (API Keys, JWT, OAuth 2.0, mTLS), REST/GraphQL testing, Burp, Postman, jwt_tool.
Endpoint Security
Application Allowlisting: Windows Defender Application Control Guide
Application allowlisting (formerly known as whitelisting) allows only explicitly approved software to run, thereby fundamentally preventing malware from executing. This article explains WDAC (Windows Defender Application Control) and AppLocker: policy creation, rule types (hash, publisher, path), CI/CD integration, audit mode, bypass techniques, and migration strategies from a "deny-all" environment to a production environment.
Anwendungssicherheit
Application Security Testing (AST): SAST, DAST, IAST and SCA
Application security testing combines four complementary testing methods: SAST (static source code analysis), DAST (dynamic testing of running applications), IAST (internal instrumentation), and SCA (third-party library analysis). This article explains how each method works, its strengths and weaknesses, how to integrate them into CI/CD, and which tools are suitable for which use cases.
Security Operations
Attack Surface Management: Know and Reduce Your External Exposure
Attack Surface Management (ASM) is the ongoing process of discovering, assessing, and monitoring all of an organization’s externally accessible assets.
Business Continuity
Backup and disaster recovery: ransomware-proof data backup
Backups are the last line of defense against ransomware and data loss.
Netzwerksicherheit
Bluetooth Security: Vulnerabilities, Attack Types and Protective Measures
Security considerations for wireless Bluetooth connections. Bluetooth attacks such as BlueBorne, BIAS, and BLUFFS enable data extraction and device control w...
Compliance & Standards
BSI IT-Grundschutz: Framework, Building Blocks and Implementation Guide
The BSI IT-Grundschutz is a framework developed by the Federal Office for Information Security that provides companies and government agencies with a systematic methodology for implementing information security - featuring highly detailed, practical components.
Schwachstellenklassen
Buffer Overflow - Stack and Heap Overflow Explained
A buffer overflow occurs when a program writes more data to a buffer than it can hold, causing adjacent memory areas to be overwritten. Buffer overflows enab...
Risikomanagement
Business continuity management (BCM): making companies crisis-proof
Business Continuity Management (BCM) is the organizational framework for maintaining critical business processes during and after crises.
PKI & Kryptographie
Certificate Transparency (CT) - Public Certificate Audit Log
Certificate Transparency (RFC 6962) is an open framework that records all issued TLS certificates in publicly verifiable, append-only logs. It was developed ...
Compliance & Governance
Cloud compliance: SOC 2, ISO 27017, ISO 27018, CSA STAR and FedRAMP
Cloud compliance standards compared: SOC 2, ISO 27017/27018, CSA STAR, FedRAMP, BSI C5 and EUCS - requirements and certification paths.
Cloud Security
Cloud detection engineering: attack detection in AWS, Azure and GCP
Cloud Detection Engineering focuses on the development, testing, and maintenance of detection rules for attacks on cloud infrastructures (AWS, Azure, GCP).
Cloud Security
Cloud IAM security: securing AWS, Azure and GCP properly
Cloud IAM Security in AWS, Azure Entra ID and GCP: Least Privilege, Permission Boundaries, Conditional Access, Federation, CSPM.
Cloud Security
Cloud Key Management: AWS KMS, Azure Key Vault and HashiCorp Vault
Cloud Key Management compared: AWS KMS, Azure Key Vault, HashiCorp Vault. CMK/DEK/KEK, envelope encryption, HSM, BYOK, key rotation.
Sicherheitsarchitektur
Cloud Security: Security in AWS, Azure and GCP - The complete guide
Cloud Security guide: Shared Responsibility Model, common misconfigurations, CSPM, IAM, encryption - for AWS, Azure and GCP.
Cloud Security
Container security and Kubernetes hardening: The complete guide
Container and Kubernetes security: 4C model, image hardening, RBAC, Pod Security Standards, NetworkPolicy, Falco, supply chain (Cosign/SLSA).
Schwachstellenklassen
CORS - Cross-Origin Resource Sharing Fehlkonfiguration
CORS misconfigurations with wildcard origins let attackers send cross-site requests with user credentials. How to detect and fix insecure CORS policies.
Compliance
Critical infrastructure (KRITIS): definition, protection and NIS2
KRITIS - Critical Infrastructure in Germany: Which sectors are affected, what cybersecurity obligations apply, and how the NIS2 Directive strengthens protection.
Kryptographie
Cryptography: encryption, algorithms, PKI and post-quantum
Cryptography fundamentals: AES, RSA, ECC, password hashing (bcrypt, Argon2), digital signatures, PKI, TLS 1.3, ML-KEM and ML-DSA.
Malware
Cryptojacking: How to Detect and Prevent Unauthorized Crypto Mining
Cryptojacking secretly uses victims' computing power to mine cryptocurrency via browser scripts or malware - how to detect and prevent unauthorized mining.
Governance, Risk & Compliance
Cybersecurity Frameworks: NIST CSF, ISO 27001, CIS Controls Compared
Cybersecurity frameworks organize security measures and enable systematic risk reduction.
Compliance & Governance
Data Governance: Managing Data as an Enterprise Asset Systematically
Data Governance: framework, roles (Data Owner, Steward, Custodian), classification, data catalog, lineage and quality.
Datenbank-Sicherheit
Database security: securing SQL Server, MySQL and PostgreSQL
Database Security for SQL Server, MySQL and PostgreSQL: hardening, least privilege, audit logging, encryption and SQL injection protection.
Bedrohungslandschaft
DDoS attacks: types, defenses and the current threat situation
DDoS Attacks Fully Explained: Volumetric, Protocol, and Application Layer Attacks - How Botnets Work, the Different Types of DDoS Attacks, and How Businesses Can Protect Themselves Effectively.
DevSecOps
DevSecOps tools comparison: SAST, DAST, SCA and Secrets Scanning
DevSecOps tools compared: Semgrep, SonarQube, Snyk, OWASP Dependency-Check and others for SAST, DAST, SCA and secrets scanning.
DevSecOps
DevSecOps: Integrating security into CI/CD pipelines
A Practical Guide to DevSecOps Implementation: How to integrate security testing into CI/CD pipelines, which tools to use for SAST, DAST, SCA, and container scanning, and how to incorporate security findings into the development workflow. Includes concrete examples using GitLab CI and GitHub Actions.
E-Mail-Sicherheit
DKIM - DomainKeys Identified Mail
DKIM is an email authentication protocol that cryptographically signs outgoing emails, thereby ensuring that the message has not been tampered with on its way to the recipient.
E-Mail-Sicherheit
DMARC - Domain-based Message Authentication, Reporting and Conformance
DMARC is an email authentication protocol that builds on SPF and DKIM and enables domain owners to prevent email spoofing and phishing attacks.
Netzwerksicherheit
DMZ - Demilitarized zone in network security
The DMZ (Demilitarized Zone) is an isolated network segment between the Internet and the internal network. Architecture, use cases, advantages and disadvantages, and best practices.
Compliance & Standards
DORA - Digital Operational Resilience Act
DORA, an EU regulation effective January 2025, sets requirements on financial firms for digital operational resilience and incident reporting.
Endpoint-Sicherheit
EDR in the company: Deployment, Tuning and Incident Response
Endpoint Detection and Response (EDR) is the critical security layer for modern endpoints.
E-Mail-Sicherheit
Email Security Architecture: DMARC, SPF, DKIM, BIMI and MTA-STS
A Complete Email Security Architecture Explained: SPF (Sender Policy Framework) prevents IP spoofing, DKIM (DomainKeys Identified Mail) cryptographically signs emails, and DMARC (Domain-based Message Authentication) combines both and establishes policies for handling failures. BIMI enables logo display in email clients as a trust signal. MTA-STS and TLS-RPT secure the transport. Includes phased implementation, DNS configuration, and monitoring.
E-Mail-Sicherheit
Email security gateway: stopping phishing and malware
Email Security Gateway Implementation: SPF/DKIM/DMARC Enforcement, Anti-Phishing (URL Rewriting, Sandboxing), anti-malware (attachment scanning, zero-day protection), Business Email Compromise (BEC) detection, comparison of secure email gateways (Microsoft Defender for Office 365, Proofpoint, Mimecast, Hornetsecurity), Email archiving for compliance, enforcing TLS encryption, and configuring DMARC reports.
E-Mail-Sicherheit
Email security: SPF, DKIM, DMARC, BIMI and MTA-STS in detail
Comprehensive Email Security Guide: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Reporting and Enforcement), BIMI (Brand Indicators for Message Identification), MTA-STS, and DANE. Includes DNS configuration examples, common misconfigurations, phased rollout, and debugging tools.
Security Operations
Endpoint Security: EDR, EPP and holistic device protection
Endpoint security protects all endpoints - laptops, servers, and mobile devices.
Security Operations
Enterprise Patch Management: Systematic Vulnerability Remediation
Patch management is the structured process of identifying, assessing, testing, and installing software updates.
Netzwerksicherheit
Firewall and NGFW: Understanding Next-Generation Network Protection
From the classic packet-filter firewall to the next-generation firewall (NGFW) with deep packet inspection, IPS, SSL inspection, and application control.
Compliance & Recht
GDPR and IT security: technical requirements, TOMs and implementation
The GDPR explicitly requires technical security measures (Art. 32).
Compliance
GRC: Governance, risk management and compliance for companies
Introduction to GRC (Governance, Risk Management, and Compliance): What GRC means, how a GRC framework is structured, which tools support it, how GRC relates to ISO 27001, NIS2, and the GDPR, and why integrated GRC is more efficient than siloed compliance approaches.
Schutzmechanismen
HSTS - HTTP Strict Transport Security
HSTS forces browsers to use HTTPS exclusively after the first connection. How to configure HSTS headers, preloading and common implementation pitfalls.
Schwachstellenklassen
HTTP Parameter Pollution (HPP) - Parameter-Verschmutzung
HTTP Parameter Pollution sends duplicate parameter names to exploit inconsistent backend parsing. How HPP enables security bypass and WAF evasion attacks.
Identitätsschutz
Identity & Access Management (IAM): Managing Identities Securely
IAM is the foundation of any zero-trust architecture. This article explains identity lifecycle management, RBAC vs.
Identity & Access Management
Identity Governance (IGA): Joiner-Mover-Leaver and Access Certs
Identity Governance and Administration (IGA) encompasses the processes for managing user identities throughout their entire lifecycle: creation during onboarding, updates during role changes, and deactivation during offboarding. IGA systems automate the assignment of permissions, enforce segregation of duties (SoD), and enable periodic access certifications.
Identity Security
Identity theft and account takeover: attacks and protective measures
Account Takeover attacks: credential stuffing, password spraying, SIM swapping, MFA bypass. Protections via Conditional Access and FIDO2.
Web-Sicherheit
IDOR - Insecure Direct Object Reference
Insecure Direct Object Reference (IDOR) is an access control vulnerability in which an application uses direct references to internal objects (user IDs, file...
Mobile Security
IMSI catcher: How it works, legal situation and protective measures
IMSI catchers are devices that force mobile phones to connect to them, thereby capturing call data and locations.
Security Operations
Incident Response: Detecting, Containing and Recovering from Cyber Incidents
Incident Response: structured process for detecting, containing, resolving and following up on cybersecurity incidents. Determines damage extent.
Compliance & Recht
Information Security Officer (ISB)
Information Security Officer (ISB): responsibilities for ISMS, risk analyses and compliance. Qualifications, NIS2 obligations, internal vs external.
Compliance & Standards
ISO 27001 - Information Security Management System (ISMS)
ISO 27001 is the international ISMS standard for establishing, operating and continually improving information security.
Grundlagen
IT Asset Management (ITAM) and Cybersecurity: Inventory Everything
Why comprehensive IT asset management is the foundation of every security strategy: CMDB concepts, software asset management, SBOM, hardware lifecycle, automated discovery tools, and how ITAM relates to ISO 27001, NIS2, and vulnerability management.
Security Operations
IT emergency management: incident response and crisis management
A structured guide to IT incident management: from developing an incident response plan and managing the first 72 hours following a cyberattack to legal reporting requirements under NIS2 and the GDPR. Includes templates and checklists.
Sicherheitsberatung
IT security concept: structure, content and implementation
An IT security policy systematically documents all measures taken to protect information security within the organization.
Netzwerksicherheit
Lateral Movement: Detection and defense in the corporate network
Lateral movement defense: Pass-the-Hash, Pass-the-Ticket, Kerberoasting, WMI/PSExec. Detection via event logs/EDR, protection with LAPS, Protected Users.
Server Security
Linux Server Hardening: CIS Benchmark, SSH, auditd and AppArmor
Comprehensive hardening guide for Linux servers based on the CIS Benchmark Level 2.
Angriffstechniken
Living off the Land (LotL) - LOLBins and LOLBas
"Living off the Land" (LotL) refers to attack techniques in which attackers use only legitimate tools and utilities already present on the system (...
Bedrohungslandschaft
Malware: types, analysis and protective measures
From viruses and Trojans to ransomware, spyware, and rootkits - an overview of all types of malware, the current threat landscape, analysis methods, and proven protective measures for businesses.
Angriffstechniken
Man-in-the-middle attacks: techniques, detection and protection
Man-in-the-middle (MITM) attacks position an attacker between communicating parties - silently, often invisibly.
Endpoint Security
Mobile Device Management (MDM): Managing Smartphones and Tablets
Mobile Device Management (MDM) enables the centralized management of smartphones, tablets, and laptops.
Endpoint Security
Mobile security: Android and iOS enterprise hardening, MDM and BYOD
Comprehensive Guide to Mobile Security for Businesses: Threat Profile (Malicious Apps, Smishing, Vishing, Network Risks), MDM vs.
Netzwerksicherheit
Network Access Control (NAC): 802.1X, RADIUS and Zero Trust
Comprehensive Guide to Network Access Control (NAC): IEEE 802.1X port-based access control, RADIUS servers (FreeRADIUS, Cisco ISE, Microsoft NPS), EAP-TLS and PEAP, Posture Assessment (Patch Status, Antivirus, Disk Encryption), VLAN-Based Quarantine, BYOD Strategies (MDM Enrollment, ZTNA), Guest Networks, MAC Address Bypass for IoT, and a Comparison of Leading NAC Solutions (Cisco ISE, Aruba ClearPass, Portnox, Forescout). Includes a rollout roadmap and NAC as a zero-trust building block.
Netzwerksicherheit
Network Detection and Response (NDR): Threat Detection in Networks
Network Detection and Response (NDR): ML behavioral analysis detects C2 traffic, lateral movement and exfiltration. Darktrace, ExtraHop, Vectra AI.
Security Operations
Network Forensics: Reconstructing Attacks in Network Traffic
Network forensics: TAP/SPAN/NetFlow capture, analysis with Wireshark, Zeek, Suricata, NetworkMiner. Evidence preservation per ISO/IEC 27037.
Netzwerksicherheit
Network security: architectures, technologies and best practices
Network security protects corporate networks from breaches, data loss, and tampering. A practical overview of firewalls, network segmentation, Zero Trust, common attacks, and penetration testing.
Compliance & Standards
NIS2 Directive: Requirements, Obligations and Implementation for Companies
The NIS2 Directive (Network and Information Security Directive 2) is an EU regulation that harmonizes and strengthens cybersecurity requirements for critical and important infrastructure.
Penetrationstest
OSINT Methods: Tools and Techniques for Open Source Intelligence
OSINT (Open Source Intelligence) refers to the systematic collection and analysis of publicly available information for security and reconnaissance purposes.
Offensive Security
OSINT: Open Source Intelligence in Cybersecurity
OSINT (Open Source Intelligence) Explained: How attackers and penetration testers use publicly available information, what tools are used, and how companies can reduce their OSINT attack surface.
OT-Sicherheit
OT/ICS Industrial Security: Protection for Plants and KRITIS Operators
Operational Technology (OT) and Industrial Control Systems (ICS) protect physical processes - from power grids to manufacturing facilities.
Schwachstellenklassen
Path Traversal - Verzeichnisüberschreitung (Directory Traversal)
Path traversal (CWE-22, OWASP A01:2021) allows attackers to access files outside the permitted directory using ../ sequences. Objective: Reading sensitive fi...
Offensive Security
Penetration Test (Pentest): Methods, Process and Results Explained
A penetration test is an authorized security test in which experts simulate real-world cyberattacks to identify vulnerabilities in IT systems, networks, or applications.
Penetration Testing
Penetration Test Methodology: PTES, OWASP, OSSTMM and BSI Guidelines
Comparison of leading penetration testing methodologies: PTES, OWASP Testing Guide, OSSTMM, BSI Guidelines (BSI-CS 115), and TIBER-EU for the financial sector.
Bedrohungslandschaft
Phishing and Social Engineering: Attack Methods and Defense
Phishing and social engineering guide: mass, spear, whaling, BEC, smishing, vishing, QR and AiTM. Cialdini, DMARC, FIDO2 MFA, awareness.
Penetrationstest
Physical penetration testing: methodology, tools and legal principles
Physical penetration testing evaluates physical security measures: access control, tailgating, lock picking, badge cloning, OSINT for physical targets, and on-site social engineering. This article explains the methodology (PTES Physical), tools (Proxmark3, Flipper Zero, lock picks), legal safeguards (authorization letters), and protective measures against physical attacks.
Grundlagen
Physical Security: Servers, Office and Access Control in IT Security
Physical security is the often-overlooked foundation of information security.
Identity Security
Privileged Access Management (PAM): Protecting Privileged Accounts
Privileged Access Management (PAM) protects the most powerful accounts in an IT environment - domain administrators, root accounts, and service accounts.
Privilege Management
Privileged Access Workstation (PAW): Secure Admin Workstations Guide
Privileged Access Workstations (PAWs) are dedicated, hardened workstations used exclusively for administrative tasks.
Schwachstellenklassen
Prototype Pollution - JavaScript-Objekt-Manipulation
Prototype pollution modifies JavaScript's Object.prototype to affect all objects. How this enables code execution and how to prevent the attack.
Schwachstellenklassen
Race Condition (TOCTOU) - Timing-Based Security Vulnerability
Race conditions (CWE-362) occur when a system's security depends on two or more operations being executed in a specific order, but parallel execution vi...
Bedrohungslandschaft
Ransomware: Protection, Detection and Response to Encryption Attacks
Ransomware is malware that encrypts a victim’s data or locks their systems and demands a ransom to unlock them. It is one of the most costly cyber threats worldwide.
Offensive Security
Red Teaming: Conducting Attack Simulations Professionally
Red Team operations: how they differ from pentests, TIBER-EU, phases from reconnaissance to reporting, C2 infrastructure, common TTPs.
Secure Development
Secure Coding Practices: Anchoring security in the development process
Secure Coding and SDLC: threat modeling, STRIDE, language patterns for Python/Java/Node/Go, SAST/DAST/SCA in CI/CD, SBOM, OWASP SAMM.
Strategie & Architektur
Security Architecture: Frameworks, Patterns and Implementation Guide
A Comprehensive Guide to Security Architecture: Zero Trust, Defense in Depth, NIST CSF, Cloud Security Architecture, Network Segmentation, and How Security Architecture Decisions Prevent or Hinder Attacks. Includes detailed architectural diagrams and implementation guidelines.
Security Operations
Security awareness training: How the human firewall really works
Security Awareness Training Done Right: Why Traditional One-Time Training Sessions Fail, What Phishing Simulations Actually Measure, and How a Sustainable Awareness Program Reduces Cyber Risks.
Governance
Security Maturity Models: CMMI, C2M2, BSIMM and OpenSAMM in comparison
Security maturity models help organizations measure the current maturity level of their cybersecurity capabilities and improve them systematically.
Security Operations
Security metrics and KPIs: making security measurable
Security metrics are proof that investments in IT security are effective.
Security Operations
Security Operations Center (SOC) and SIEM: monitor cybersecurity 24/7
SOCs and SIEMs form the foundation of any professional threat detection system.
Schwachstellenklassen
Server-Side Template Injection (SSTI) - Template Engine Attacks
SSTI occurs when user input is inserted into template engines without escaping. How attackers exploit template syntax for remote code execution.
Schwachstellenklassen
Session Fixation - How Attackers Hijack Sessions via Preset IDs
Session fixation attacks provide victims with a pre-set session ID before login. How attackers hijack authenticated sessions and how to prevent it.
Security Operations
SOAR: Security Orchestration, Automation and Response implementieren
Security Orchestration, Automation, and Response (SOAR) automates repetitive SOC tasks and reduces the Mean Time to Respond (MTTR) from hours to minutes.
Bedrohungslandschaft
Social engineering: psychological manipulation tactics in IT security
Social Engineering Explained: Pretexting, Baiting, Tailgating, Quid pro Quo - all types of attacks, the psychological tactics behind them, and effective countermeasures.
DevSecOps
Software Supply Chain Security: SLSA, Sigstore and Dependencies
Software supply chain security protects the entire software development process from compromise - from source code repositories to build systems and package registries. SLSA (Supply-chain Levels for Software Artifacts) defines security levels for build processes. Sigstore enables transparent code signing. This article explains SolarWinds, XZ Utils, and other supply chain attacks, as well as practical countermeasures.
E-Mail-Sicherheit
SPF - Sender Policy Framework: Prevent Email Spoofing with DNS Records
SPF is a DNS-based email authentication protocol that specifies which mail servers are authorized to send emails on behalf of a domain, thereby preventing email spoofing.
Bedrohungslandschaft
Supply chain attacks: SolarWinds, Log4Shell and the invisible threat
Supply Chain Attacks Explained: How SolarWinds, Log4Shell, and XZ Utils Work, Why They Are So Dangerous, and How Companies Can Secure Their Software Supply Chain.
Security Operations
Threat Intelligence: Understanding Attackers Before They Strike
Threat Intelligence: systematic collection of threat actor data, attack methods and IoCs. OSINT to commercial feeds, operational use.
Security Architecture
Threat Modeling Frameworks: STRIDE, PASTA, LINDDUN and MITRE ATT&CK
Threat Modeling: STRIDE, PASTA, LINDDUN, DREAD and MITRE ATT&CK integration with DFD and tools (Threat Dragon, Microsoft TMT).
Compliance & Standards
TISAX (Trusted Information Security Assessment Exchange)
TISAX is the automotive-industry security standard based on the VDA ISA questionnaire and managed by the ENX Association - required for OEM suppliers.
Hardware-Sicherheit
TPM (Trusted Platform Module): Hardware-Based Security for Enterprises
TPM (Trusted Platform Module): dedicated security chip on the motherboard for key storage, boot integrity and hardware root of trust.
Security Operations
UEBA (User and Entity Behavior Analytics)
UEBA detects insider threats and compromised accounts by baselining normal behavior and alerting on statistical anomalies across users and systems.
Vulnerability Management
Vulnerability Disclosure: CVD, VDP, Bug Bounty and Responsible Disc.
Vulnerability Disclosure: CVD process, VDP vs bug bounty, Security.txt (RFC 9116), responsible disclosure with safe harbor clauses.
Security Operations
Vulnerability Management: Systematic Approach in Practice
Vulnerability management is more than just regular scans - it is a continuous process involving detection, assessment, prioritization, remediation, and verification. This article explains the full VM program: scanner selection, CVSS vs. EPSS prioritization, patch SLAs, metrics, and integration with DevSecOps and ISMS.
Security Operations
Vulnerability management: The complete guide
Implementing systematic vulnerability management: from detection and prioritization to remediation - using CVSS, EPSS, and patching strategies.
Secure Development
Web application security: OWASP Top 10, security testing and WAF
Web App Security: OWASP Top 10, WSTG methodology, Burp Suite, Nuclei scanning, security headers, WAF - PCI DSS, ISO 27001, NIS2 compliance.
Angriffstechniken
Web Cache Poisoning - Cache-Based Attack
Web cache poisoning uses unkeyed HTTP headers to inject malicious content into caches. How attackers exploit this to serve harmful responses to all users.
Offensive Security
Web scraping: techniques, legal situation and defensive measures
Web scraping refers to the automated extraction of web content.
Endpoint-Sicherheit
Windows Server Hardening: CIS Benchmark and Security Baseline
Systematic hardening of Windows Server 2019/2022 according to CIS Benchmark Levels 1/2 and the Microsoft Security Baseline: Disable services, disable SMB v1, restrict NTLM, enable LAPS v2 for local administrator passwords, PowerShell hardening, Windows Firewall, audit policies (auditpol), Protected Users security group, Credential Guard, AppLocker, and enforce TLS 1.3. Includes prioritized PowerShell scripts and compliance checks.
Netzwerksicherheit
WLAN security in the company: From WPA3 to 802.1X
Enterprise Wi-Fi Security: WPA3-Enterprise vs. WPA3-SAE, 802.1X Authentication (RADIUS + EAP-TLS/PEAP), SSID Segmentation (Corporate vs. BYOD vs.
Web-Sicherheit
XXE - XML External Entity Injection
XXE Injection exploits XML parsers to read local files, perform SSRF or execute code. How the attack works and how to disable external entity processing.
Sicherheitsarchitektur
Zero Trust - Modern Security Architecture Principle
Zero Trust is a security paradigm based on the principle of "never trust, always verify": No user, device, or network segment is implicitly trusted - every access request is explicitly verified.
