Hardened by design. Rebuilt after a breach.
Security-hardened infrastructure aligned to measurable standards, with the capability to eradicate an adversary and rebuild after one gets in. We design and operate these environments to meet the security requirements defined at project start.
CIS BenchmarksDISA STIGsNIST 800-207NIST 800-53CSA CCM
HARDENING
Systems, endpoints, identity.
System & Endpoint Hardening
- CIS Benchmark Level 1 & 2 · OS hardening for Linux (RHEL, Ubuntu, Debian), Windows Server, macOS, and container base images
- DISA STIGs · applied where defence, government, or regulated industry mandates the standard
- Kernel hardening · seccomp profiles, AppArmor / SELinux policies, sysctl tuning, and module blacklisting
- Container hardening · rootless execution, read-only filesystems, capability dropping, Kubernetes Pod Security Standards enforcement
- Endpoint protection · EDR deployment and tuning, application allowlisting, script execution controls, and USB/removable media policy
- Automated compliance drift detection keeps baselines enforced after build and throughout operation
Identity & Privileged Access
- Privileged Access Management (PAM) · vault-based credential management, session recording, and checkout/check-in workflows for administrative accounts
- Just-in-time (JIT) access · time-limited privilege elevation with approval workflows; no standing admin accounts
- Privileged Access Workstations · hardened, isolated workstations for administrative tasks; separated from general-purpose endpoints
- Directory service hardening · tiered administration model, Kerberoastable account elimination, local admin password management, and legacy protocol disablement
- Conditional access & MFA · phishing-resistant MFA (FIDO2/passkeys), risk-based access policies, and device compliance enforcement
ZERO TRUST
Continuous verification, end to end.
Aligned to NIST SP 800-207. Perimeter trust replaced by continuous verification, with identity, device health, and context evaluated at each access decision.
Network Segmentation
- Micro-segmentation with host-based firewalls and east-west traffic controls
- VLAN / VPC design with explicit trust boundaries and inter-segment access lists
- Service mesh for mutual TLS and fine-grained workload authorisation
- Network access control (NAC) for device trust before admission to corporate segments
Cloud Security Posture
- CSPM · cloud security posture management deployment with benchmark mapping and continuous alerting
- IAM least-privilege analysis and standing permission elimination
- Object storage public access auditing and data classification enforcement
- Cloud provider activity log integrity and centralised SIEM ingestion
- IaC security scanning integrated into deployment pipelines
Perimeter & Remote Access
- Zero Trust Network Access (ZTNA) replacing legacy VPN, with identity- and device-aware access
- WAF deployment and tuning with OWASP rule sets and custom application logic
- DNS security (DNSSEC, RPZ, DoH/DoT) and threat intelligence-backed DNS filtering
- DDoS protection and rate-limiting architecture for externally exposed services
POST-BREACH REMEDIATION
Eradicate, rebuild, re-harden.
Incomplete remediation (leaving a single persistent backdoor, a reused credential, or an unpatched initial access vector) can leave a route for reintrusion. Our structured remediation addresses the root cause and verifies the result.
Eradication
- Removal of all confirmed persistence mechanisms: scheduled tasks, services, registry keys, cron jobs, startup items, and implants
- Credential reset programme: domain-wide forced rotation of all accounts exposed within adversary blast radius, prioritised by privilege tier
- Certificate and API key revocation for any secrets present in compromised systems
- C2 infrastructure blocking: IOC-based firewall rules, DNS sinkholes, and email gateway blocks
Rebuilding
- Clean-image rebuilds from known-good baselines for confirmed compromised systems instead of in-place cleaning of high-value targets
- IaC-driven environment reconstruction with hardened baseline applied from first boot
- Integrity verification of rebuild outputs before systems return to production
- Staged return-to-service under enhanced monitoring to detect adversary re-entry attempts
Re-hardening & Gap Closure
- Initial access vector closure: each confirmed entry point receives a patch, configuration change, or architectural fix
- Control gap remediation mapped directly from forensic findings to specific infrastructure changes
- Detection engineering: new SIEM rules and EDR detections covering TTPs used in the incident
- Hardening re-baseline: CIS benchmark re-assessment across the affected scope post-rebuild
OPERATIONS
Security-first managed operations.
Managed Security Operations
- 24/7 security monitoring · SIEM-driven alerting with triage by security-qualified analysts, not generic helpdesk
- Patch management · vulnerability-prioritised patching cadence aligned to CVSS severity and active exploitation status
- Configuration management · IaC-driven drift detection; no manual changes without documented approval and change record
- Vulnerability scanning · continuous authenticated scanning with prioritised remediation tracked against SLA
- Backup & DR testing · restoration tests verify backup integrity, with backup-job success logs retained as supporting evidence
- Monthly security posture reports with trend metrics and open risk register
SLAs & Governance
- Incident response SLAs · Critical: ≤15 min acknowledgement; High: ≤30 min; Medium: ≤2 hours; all tracked and reported monthly
- Change management · no significant configuration changes without client-approved change record; emergency changes ratified within 24 hours
- Responsibility matrix (RACI) · operational task ownership documented explicitly before engagement start
- Access governance · quarterly review of all Grilli Security access to client systems; access revoked same day upon engagement close
- All operational work covered by NDA; client retains ownership of all infrastructure, IaC, and documentation
DELIVERABLES
What you take away.
Engineering
- IaC modules with security controls encoded, tested, and documented
- Hardening scripts and configuration baselines mapped to CIS Benchmark level and version
- Network diagrams with trust boundaries, data flows, and security control placement
- PAM/JIT configuration with access policy documentation
- CI/CD pipeline security gate configuration and policy-as-code rules
Remediation
- Eradication plan with system-by-system action log and verification record
- Credential reset scope and completion confirmation
- Rebuild documentation: baseline version, hardening applied, and integrity verification results
- Post-remediation hardening report: CIS benchmark re-assessment scores before and after
- Root cause and control gap closure evidence suitable for regulatory or insurance reporting
Operations
- Runbooks for all operational procedures: incident, change, backup, DR, and escalation
- Architecture decision records (ADRs) with security rationale for all significant design choices
- Monthly security posture report with vulnerability trends, patch compliance, and open risk register
- Quarterly DR test report with actual RTO/RPO achieved vs. target
Get a written proposal
Send scope + timeline. Initial response and next steps within 1 business day; proposal timing is confirmed after scoping.
Open the form →
Email a senior practitioner
Direct line for scoping questions. NDA available on request before you share details.
hello@grillisecurity.com →
Active incident?
24/7 incident line. Triage call + retainer set-up inside the hour for new engagements.
+372 5610 1641 →