FREE HARDENING TOOL

Lockdown Lab

Free, CISO-authored cybersecurity hardening advisor. Daily, vendor-specific lockdown guides — published across the website, LinkedIn and Telegram. Built for SOC analysts, IT defenders, sysadmins and CISOs who need actionable hardening, not generic checklists.

Lockdown Lab is a free hardening tool maintained by a working CISO. Each entry is a single, copy-pasteable lockdown step for a specific vendor or platform — Microsoft Windows, Azure, M365, AWS, Active Directory, Linux, network gear and emerging AI/LLM stacks. Tips are severity-tagged (Critical → Low) so you patch what actually matters first. Unlike generic CIS-style benchmarks, every Lockdown Lab tip ships with the exact command, registry key, GPO setting or console toggle you need.

Subscribe on Telegram Hardening Matrix →
🔍
Severity
Platform

Enforce MFA (2-Step Verification) org-wide

Remember the Mandiant X account breach in 2023? No MFA on a critical account. That's a textbook example of why this isn't just a "good...

lockdown-labhardeninggcpidentity
/Shimi Cohen

Block public S3 bucket access

Another week, another data leak from an S3 bucket left wide open. This isn't theoretical; I see it almost weekly in breach reports. It's security...

lockdown-labhardeningawsencryption
/Shimi Cohen

Block public S3 bucket access

I've seen it too many times: an S3 bucket accidentally exposed, data spilled, and the clean-up is a nightmare. This isn't rocket science, it's basic...

lockdown-labhardeningawsencryption
/Shimi Cohen

Disable unnecessary Windows features

Every unnecessary feature on your Windows Server is a potential attack surface. It’s a basic hardening principle, yet I still find environments riddled with dormant...

lockdown-labhardeningwindowsservices
/Shimi Cohen

Disable unnecessary Windows features

Every unnecessary feature on your Windows Server is a potential attack surface. Period. You wouldn't leave an unlocked window open on your house, so why...

lockdown-labhardeningwindowsservices
/Shimi Cohen

Enable and configure auditd

Attackers love operating in the dark. If you're not logging critical security events on your Linux servers, you're handing them a permanent stealth cloak. Remember...

lockdown-labhardeninglinuxlogging
/Shimi Cohen

Enable and configure auditd

The SolarWinds attack showed us a painful truth: a lack of comprehensive audit logging allowed attackers to remain undetected for months. If you can't see...

lockdown-labhardeninglinuxlogging
/Shimi Cohen

Enforce HTTPS on storage accounts

Forget sophisticated attacks for a moment. How many times have we seen sensitive data exposed because someone forgot the absolute basics? Unencrypted data in transit...

lockdown-labhardeningazureencryption
/Shimi Cohen

Enforce HTTPS on storage accounts

You'd be shocked how many "secure" environments still allow unencrypted traffic to their Azure storage. This isn't theoretical; it's a direct path for data interception....

lockdown-labhardeningazureencryption
/Shimi Cohen

Enable default S3 bucket encryption

Another day, another S3 breach. This isn't just a recurring theme; it's a security epidemic. If your S3 buckets aren't encrypted by default, you're practically...

lockdown-labhardeningawsencryption
/Shimi Cohen

Enable default S3 bucket encryption

Another day, another S3 breach headline. It's 2024, and unencrypted S3 buckets are still a recurring nightmare for organizations. This isn't rocket science, people. Even...

lockdown-labhardeningawsencryption
/Shimi Cohen

Enable BitLocker on all volumes

You’ve got a server compromised. The attacker exfiltrates data. You know this story. But what about the physical theft of a server, a drive, or...

lockdown-labhardeningwindowsencryption
/Shimi Cohen

Enable BitLocker on all volumes

You think your data is safe behind your firewall? Think again. A stolen laptop, a rogue insider, or even a discarded drive from a decommissioned...

lockdown-labhardeningwindowsencryption
/Shimi Cohen

Disable ICMP redirects

Thinking a Man-in-the-Middle (MitM) attack only happens over Wi-Fi? Think again. Your Linux servers, if not properly configured, can be tricked into redirecting traffic right...

lockdown-labhardeninglinuxnetwork
/Shimi Cohen

Enable Azure Disk Encryption

Think your data in Azure is safe just because it's "in the cloud"? Think again. If your VM disks aren't encrypted at rest with ADE,...

lockdown-labhardeningazureencryption
/Shimi Cohen

Enable GuardDuty

Think about the last time you saw a breach report where an attacker lingered in an AWS account for weeks, undetected. This isn't theoretical. It's...

lockdown-labhardeningawslogging
/Shimi Cohen

Enable GuardDuty

Think about the last time you saw a breach notification. How many of those could have been caught earlier, or prevented entirely, if someone was...

lockdown-labhardeningawslogging
/Shimi Cohen

Configure Windows Event Forwarding (WEF)

If an attacker is moving laterally through your Windows network right now, and you can't see their steps, you've already lost. Most organizations are blind...

lockdown-labhardeningwindowslogging
/Shimi Cohen

Disable IP forwarding

Lateral movement. That's the nightmare scenario this simple hardening tip helps prevent. A compromised server shouldn't automatically become a pivot point to your entire network....

lockdown-labhardeninglinuxnetwork
/Shimi Cohen

Enable diagnostic logging for key resources

Think about the last time you had an incident. If you couldn't tell who did what, when, or how, your response was already crippled. That's...

lockdown-labhardeningazurelogging
/Shimi Cohen

Enable CloudTrail in all regions

Let's talk about the first thing sophisticated attackers go after: your audit trail. If they can blind you, they own you. CloudTrail is that trail...

lockdown-labhardeningawslogging
/Shimi Cohen

Enable PowerShell script block logging

Attackers live in PowerShell. Your incident response team will be blind without proper logging. This is how you catch them before they pivot from initial...

lockdown-labhardeningwindowslogging
/Shimi Cohen

Configure firewall (iptables/nftables)

You wouldn't leave your front door wide open when you leave the house, so why are you doing it with your Linux servers? An open...

lockdown-labhardeninglinuxnetwork
/Shimi Cohen

Enable Microsoft Defender for Cloud

I've seen environments fall apart because basic monitoring wasn't in place. Attackers love flying under the radar. If you're running Azure without Defender for Cloud,...

lockdown-labhardeningazurelogging
/Shimi Cohen

Remove 0.0.0.0/0 from security groups

The Capital One breach in 2019? A misconfigured security group allowing SSRF to the metadata service. This isn't theoretical; unrestricted inbound access is a primary...

lockdown-labhardeningawsnetwork
/Shimi Cohen

Disable SMBv1

WannaCry, NotPetya, EternalBlue. These aren't ancient history; they're a stark reminder of what happens when you leave an ancient, vulnerable protocol like SMBv1 enabled. It's...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen

Disable SMBv1

WannaCry, NotPetya, EternalBlue. If those names don't send a shiver down your spine, you've been lucky. The common thread? SMBv1. This isn't ancient history; it's...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen

Lock inactive user accounts

That dormant account for a contractor who left six months ago? It's a gold mine for an attacker. I've seen too many breaches start with...

lockdown-labhardeninglinuxidentity
/Shimi Cohen

Configure Network Security Groups (NSGs)

I've walked into far too many Azure environments where the perimeter is a sieve. The most common culprit? Missing or misconfigured Network Security Groups. This...

lockdown-labhardeningazurenetwork
/Shimi Cohen

Enforce least privilege IAM policies

You know what gets me? Seeing environments where a single compromised credential can bring down a whole AWS account. Nine times out of ten, it’s...

lockdown-labhardeningawsidentity
/Shimi Cohen

Enable Windows Firewall on all profiles

How many times have I seen "unauthorized access" turn out to be a lack of basic perimeter control? Far too many. If your Windows Servers...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen

Restrict sudo access

How many times have we seen an attacker gain a foothold, then immediately escalate privileges because everyone has sudo access? It’s not a theoretical threat;...

lockdown-labhardeninglinuxidentity
/Shimi Cohen

Enable Privileged Identity Management (PIM)

Let’s talk about a common mistake: permanent admin access. It’s a ticking time bomb. Every breach I’ve analyzed involved an attacker eventually getting their hands...

lockdown-labhardeningazureidentity
/Shimi Cohen

Enforce MFA for IAM users

A compromised AWS console is a full-blown incident. You're looking at data exfiltration, service disruption, and massive reputational damage. And it almost always starts with...

lockdown-labhardeningawsidentity
/Shimi Cohen

Require NTLMv2 and refuse LM/NTLMv1

Stop handing attackers your credentials on a silver platter. I've seen far too many environments where a simple NTLM relay or brute-force attack on weak...

lockdown-labhardeningwindowsidentity
/Shimi Cohen

Set password complexity and aging

Weak passwords are still the number one attack vector. Period. I've seen countless environments where a breach started with a simple brute-force or credential stuffing...

lockdown-labhardeninglinuxidentity
/Shimi Cohen

Disable legacy authentication protocols

If you're still allowing legacy authentication protocols like IMAP or POP3, you're handing attackers a bypass around your MFA. It’s like putting up a reinforced...

lockdown-labhardeningazureidentity
/Shimi Cohen

Eliminate root access keys

I've seen environments where a single compromised root access key brought an entire AWS account to its knees. That's not a drill. That's game over...

lockdown-labhardeningawsidentity
/Shimi Cohen

Enforce account lockout policy

Brute-force attacks against user accounts are not sophisticated, but they are incredibly effective. If your Windows Servers aren't locking accounts, you're essentially providing an infinite...

lockdown-labhardeningwindowsidentity
/Shimi Cohen

Enforce SSH key-based authentication

Let's talk about the lowest hanging fruit for botnets: password-based SSH. If you're still allowing it, you're not just leaving a door open; you're putting...

lockdown-labhardeninglinuxidentity
/Shimi Cohen

Enable MFA for all users

If a single stolen password can unlock your entire Azure estate, you're not just at risk, you're practically inviting disaster. This isn't theoretical; this is...

lockdown-labhardeningazureidentity
/Shimi Cohen

Enable MFA for all users

If I had a nickel for every breach that started with a single compromised password, I'd have retired years ago. It's the oldest trick in...

lockdown-labhardeningazureidentity
/Shimi Cohen

Enable MFA on root account

Let's talk about the keys to the kingdom. Your AWS root account is exactly that – unrestricted access to everything, including billing. I've seen organizations...

lockdown-labhardeningawsidentity
/Shimi Cohen

Rename and disable built-in Administrator

If you’re still running default Administrator accounts on your Windows Servers, you’re practically handing attackers a key. This isn't theoretical; tools like Mimikatz and CrackMapExec...

lockdown-labhardeningwindowsidentity
/Shimi Cohen

Restrict who can create and publish Copilot Studio agents

Shadow IT is bad enough. Add generative AI, and you’ve got a recipe for serious data exfiltration. I’ve seen organizations completely miss this control. Any...

lockdown-labhardeningcopilot-studioservices
/Shimi Cohen

Frequently Asked Questions

Is Lockdown Lab really free?

Yes. Every hardening tip is free to read on this site, on Telegram and on LinkedIn. No email gate, no paywall.

How often is it updated?

New hardening tips are published on a daily cadence across cloud (Azure, AWS, GCP), identity (Microsoft Entra, Okta), endpoint (Windows, macOS, Linux), network and emerging AI security stacks. Subscribe on Telegram or LinkedIn for instant delivery.

How is this different from CIS Benchmarks or vendor docs?

CIS Benchmarks are exhaustive PDFs for compliance teams. Microsoft / AWS docs are written by vendors for their own products. Lockdown Lab is field-driven: one tip at a time, ranked by severity, written by an active CISO who actually deploys these controls in production.

Which platforms and vendors are covered?

Microsoft Windows / Server, Azure, Microsoft 365, Active Directory, Entra ID, AWS, Google Cloud, Linux distributions, common firewalls and EDR/XDR platforms, and emerging AI/LLM security topics. Coverage expands continuously based on real-world incident trends.

Can I request a vendor or topic?

Yes — message the bot at @Shimiscyberworldbot or open an issue. Field requests from CISOs, SOC analysts and sysadmins drive the publishing roadmap.