Leftover access
Control 6 of my CIS IG1 assessment is two safeguards, granting access and revoking it. I scored both Not Applicable, and both write-ups are mostly about one account I gave my son for a 4-minute test.
Writing
-
-
I bridged them on purpose
I started a CIS Controls v8.1 IG1 assessment of my own environment. The boundary came out at seven assets instead of three, the lab had been on my LAN on purpose since a course told me to put it there, and the finding I liked least was the one I couldn't inspect.
-
The threshold that locked me out
My detector blocks an IP after 3 failed passwords in 600 seconds. I replayed 34 days of real auth logs to find out whether that number deserved to be there, and the only legitimate user it would have blocked was me.
-
Why I'm writing in public
Every piece of advice I've gotten about learning security came with an equal and opposite piece of advice. This is me asking to be corrected out loud.