CIS Controls for Network Security: From Framework to Firewall Policy
CIS Controls v8 tells you to implement network segmentation and default-deny policies, but it does not tell you how to write the firewall rules. Here is how the framework translates into concrete policy and how implementation groups help teams prioritise.
July 4, 2026
What PCI-DSS Actually Expects from Your Firewall Rules
PCI-DSS v4.0.1 sets specific expectations for firewall policy that go well beyond 'have a firewall.' Here is what the standard actually requires and how teams can map those requirements to concrete rules.
June 20, 2026
ICS and SCADA Protocols: Why Industrial Networks Need Hard Boundaries
Industrial control system protocols have no authentication, no encryption, and were never meant to see a routable network. Isolating them behind strict network boundaries is not optional.
June 6, 2026
DNS: The Protocol Everyone Allows and Attackers Love
DNS is the most overlooked gap in firewall policy. The default 'allow DNS everywhere' stance is a segmentation failure that gives attackers a reliable, nearly invisible exfiltration path.
May 23, 2026
Container and Orchestration APIs: When One Open Port Means Full Cluster Access
An exposed Docker or Kubernetes API port gives attackers root-level or cluster-level control through a single connection. These are not services that degrade gracefully when misconfigured; they hand over the keys entirely.
May 9, 2026
The Plaintext Problem: Why FTP, Telnet, and SNMP v1 Should Be Gone by Now
Plaintext protocols persist in enterprise networks because nobody prioritises replacing them until credentials leak. Here is why FTP, Telnet, and SNMP v1/v2c are still the easiest way for an attacker to harvest passwords from your wire.
April 25, 2026
Database Ports Don't Belong on the Open Network
Database ports should never be directly reachable from broad network segments, and what happens when they are ranges from data theft to full infrastructure compromise.
April 11, 2026
Can Every Pod in Your Cluster Talk to Every Other Pod?
If your Kubernetes cluster has zero NetworkPolicies, every pod can reach every other pod on every port. No restrictions. No segmentation. A flat, open network. Is that what you intended?
April 3, 2026
Does Your CI/CD Pipeline Let Build Agents Talk to Any IP on the Internet?
If your CI/CD build agents have unrestricted outbound network access, they are one compromised dependency away from exfiltrating every secret in your pipeline. Most organizations allow exactly that.
April 1, 2026
Lock Down Your Management Ports Before Ransomware Does
RDP abuse appeared in 90% of ransomware IR cases in 2023. Not phishing. Not zero-days. A firewall rule that seemed harmless six months ago.
March 28, 2026