Security Baselines Are Boring and That's the Point
Security conferences are full of zero-days, APT groups, and novel attack chains. Real security work is mostly about making sure nobody set "Password never expires" on a service account in 2016 and forgot about it.
The security problems that actually cause incidents
I've been doing this for 20 years. Every security incident I've responded to fell into one of three categories:
Known vulnerabilities with available patches. The patch was released months ago. Nobody applied it. This accounts for the majority of incidents. Automating patch deployment isn't glamorous, but it prevents more incidents than any security product you can buy.
Misconfiguration. A storage account with public access. A network security group with an overly permissive rule. An admin account with no MFA. These aren't sophisticated attacks. They're configuration mistakes that anyone could exploit. Baseline configuration standards would have prevented them. Nobody had time to write them.
Credential compromise. Password reuse. Phished credentials. Service account passwords that haven't changed in years. MFA would have stopped most of these. Conditional Access would have stopped more. Password hygiene would have stopped the rest.
Notice a pattern? None of these are zero-days. None require an APT. All are preventable with basic security hygiene that most organisations know they should do but haven't done.
My baseline approach
I maintain a security baseline document for every environment. It's not long. It covers:
Patch management. All security updates within 14 days of release. Critical updates within 48 hours. Zero-day mitigations same-day. If you can't hit these targets, document why. "We can't patch because the application vendor hasn't certified the update" is valid. "We haven't gotten around to it" is not.
MFA everywhere. No exceptions for administrators. No exceptions for executives. No exceptions for "it's inconvenient." MFA is the single most effective security control available. Not having it is negligence.
Least privilege. Nobody has more access than they need. Domain Admins are a break-glass account, not a daily driver. Privileged access requires just-in-time elevation with approval. Audit privileged group membership monthly.
Network segmentation. Production is isolated from development. User networks are isolated from server networks. DMZ is isolated from internal. Every boundary has explicit rules. No "allow any" rules that accumulated over years.
Backup verification. Backup without restore testing isn't backup. It's hope. Restore tests happen monthly.
The automation problem
Security tools generate noise. A vulnerability scanner in an environment of 500 servers will produce thousands of findings. Most are false positives or low severity. The challenge isn't finding vulnerabilities. It's triaging them.
I triage findings into three buckets: fix now (exploitable, internet-facing, high impact), fix this sprint (exploitable but requires local access, or lower impact), and document (theoretical, requires unrealistic conditions). The first bucket is always small. Prioritise it. The third bucket is where time gets wasted — teams spend hours debating vulns that will never be exploited while a real misconfiguration sits in production.
Security is a practice, not a project. You don't "complete" security and move on. You maintain it, audit it, and improve it continuously. It's boring work. That's the point. Exciting security work means something already went wrong.