Knowledge Base
Quick-reference guidance on the topics that come up most in our penetration tests and consultancy work.
Web security
Browser-side protections and what the server has to send for them to work.
Cryptography
Transport security configuration and the certificates behind it.
User account security
Passwords, lockout and sessions: the controls we test on every authenticated application.
How account lockout prevents online password guessing, the denial of service it can introduce, and why exponential backoff beats a fixed lockout duration.
Inactivity and absolute timeouts, logging off properly, ending other sessions and handling simultaneous logins, without driving users to weaker passwords.
What makes a password strong, why complexity rules and forced rotation backfire, and what to require instead.
IT security policies
How to write policies people will read, plus starting points for the common ones.
Version control, ownership, purpose, scope, plain English, exceptions and violations: the structure every policy needs.
Personal use, scope, monitoring rights and prohibited uses: the decisions an acceptable use policy has to make explicitly, with a starting template.
Decide what the policy is for first: banning tools, banning uses, or controlling data sharing. Then a starting template covering each.
Nothing matches that. Try a different word, or ask us directly.
The guidance is free. If you'd like us to check the rest, that's what we do.