SYS-03 // SECURITY & HARDENING ARCHITECTURE

Server & Network Hardening

Defensive systems engineering, CIS Benchmark OS lockdowns, zero-trust East-West network segmentation, and Active Directory privilege tiering to eliminate ransomware lateral movement.

Request Architecture Review → Direct Dispatch: (407) 917-5250

ARCHITECTURAL SCHEMATIC: SYS-03 TOPOLOGY VECTOR SVG RENDERING • AIR-GAPPED FABRIC

COMPLIANCE BASELINE

CIS Level 2 Hardened

GPO & DSC automated baselines

ATTACK SURFACE

92% Exposure Reduction

Legacy protocols eliminated

PRIVILEGE TIERING

Tier 0 / 1 / 2 Model

Zero cross-tier admin tokens

CRYPTOGRAPHY

TLS 1.3 Strict Ciphers

AES-256 GCM authenticated

CAPABILITY CATALOG // SYS-03

Architectural Capabilities & Deliverables

Specific technical interventions, deployment baselines, and governance deliverables included in this practice.

CIS Benchmark OS Hardening

Automated Group Policy and PowerShell DSC baselines implementing Center for Internet Security (CIS) Level 1 and Level 2 security controls across Windows Server and Linux hosts.

East-West Internal Segmentation

Elimination of flat corporate networks through Layer 3 inter-VLAN stateful inspection, restricting lateral traffic between endpoints, application tiers, and database engines.

Active Directory Privilege Tiering

Strict structural separation between Tier 0 (Domain Controllers, PKI), Tier 1 (Member Servers, Storage), and Tier 2 (Workstations), blocking Pass-the-Hash and Kerberoasting attacks.

Attack Surface Reduction

Systematic disabling of insecure legacy protocols including SMBv1, NetBIOS over TCP/IP, LLMNR, NTLMv1, TLS 1.0/1.1, and unauthenticated RPC services.

Local Administrator Password Solution

Deployment of Windows LAPS with automated, randomized 24-character local administrator passwords escrowed cryptographically to Entra ID or Active Directory.

Immutable Audit Logging & Syslog

Centralized forwarding of Windows Security Event Logs, Sysmon telemetry, and firewall flows to an isolated, tamper-proof syslog vault for rapid incident forensics.

TECHNOLOGY ECOSYSTEM // PLATFORMS & STANDARDS

Supported Technology Stacks & Protocols

Vendor-neutral integration across enterprise hardware, hypervisors, and cloud environments.

Standards & Frameworks

• CIS Benchmarks Level 1 & 2
• NIST SP 800-53 Rev 5
• MITRE ATT&CK Mitigation Matrix
• HIPAA Security Rule § 164.312

Identity Hardening

• Windows LAPS
• Active Directory Administrative Tiering
• Kerberos Armoring
• Protected Users Group

Perimeter & Firewalls

• Fortinet FortiOS
• pfSense Plus Hardware Appliance
• OPNsense Core
• Palo Alto Networks PAN-OS

Telemetry & Auditing

• Sysmon (System Monitor)
• Elastic Agent / Beats
• Graylog Immutable Syslog
• Snort / Suricata IDS

PROVEN FIELD EXECUTION // CASE STUDY

Commercial Contractor: Flat Subnet Remediation & Cyber Insurance Compliance

The Challenge

A commercial contractor was denied cyber insurance renewal due to a flat 192.168.1.0/24 subnet, shared local administrator credentials across 65 workstations, and unsegmented HVAC controller access.

Engineering Solution

Steve Cormier re-engineered the network into five isolated 802.1Q VLANs with strict firewall rules, enforced CIS Level 2 GPO baselines, deployed Microsoft LAPS, and disabled LLMNR/NBT-NS.

Quantified Outcome

Achieved 100% sign-off from the cyber insurance underwriter, reduced external attack surface by 92%, and quarantined building automation systems from production corporate data.

DIRECT ENGAGEMENT WITH STEVE CORMIER