The Security Brutalist’s Guide to Basic Security Hygiene
No Frills. No Excuses. Just Discipline.
Security Brutalism isn't about chasing the latest buzzwords, drowning in dashboards, or installing 47 overlapping tools that all alert you to the same non-issue. It’s about doing the hard, simple things well—over and over—until they’re muscle memory.
Here’s your no-BS guide to basic security hygiene, brutalist-style.
1. Patch Like a Maniac
What to do: Patch critical vulns within days, not months. Automate where you can. Track what slips.
Why it matters: Ransomware doesn’t wait for your next quarterly change window.
Brutalist move: If it’s internet-facing and unpatched, treat it like it’s already compromised.
2. MFA or GTFO
What to do: Enforce phishing-resistant MFA on all access—especially for email, VPNs, admin panels, and prod.
Why it matters: Passwords are lies we tell ourselves.
Brutalist move: If it can’t support MFA, isolate it like a biohazard.
3. Kill Local Admin Rights
What to do: Strip end users of local admin. Period.
Why it matters: Malware loves privilege more than hackers do.
Brutalist move: Your execs don’t need admin rights to open PowerPoint.
4. Log Like You Mean It
What to do: Centralize and retain logs for key systems. Monitor for anomalies, not just alerts.
Why it matters: If it’s not logged, it didn’t happen—or worse, you’ll never know it did.
Brutalist move: Build your detections like you’re under attack right now.
5. Backup Like a Paranoid Historian
What to do: Regular, encrypted, tested backups. Offsite or immutable.
Why it matters: Backups are your last line. Don’t let them fail like your first five lines of defense.
Brutalist move: Test restores quarterly. If it hasn’t been tested, it’s not a backup—it’s a liability.
6. Least Privilege, Everywhere
What to do: No user, process, or system gets more access than it absolutely needs.
Why it matters: Flat networks and overprivileged accounts are hacker playgrounds.
Brutalist move: Design access like you distrust everyone. Because you should.
7. Security Training That Doesn’t Suck
What to do: Ditch the click-through eLearning. Do live demos. Teach real threats. Show real consequences.
Why it matters: People remember stories, not slides.
Brutalist move: Social engineer your execs once a year. Share the scoreboard. No exceptions.
8. Inventory or Die Trying
What to do: Know what you own. Assets, SaaS, APIs, endpoints, rogue printers—all of it.
Why it matters: You can’t secure what you don’t know exists.
Brutalist move: Build automation that flags surprises. Surprises are where breaches begin.
Final Word from the Brutalist Playbook
Security hygiene isn’t glamorous. It’s not sexy. It’s repetition, constraint, and discipline. Like sharpening a blade: small, deliberate strokes every damn day.
So patch your crap, kill your admin rights, and back up like your job depends on it—because it does.
And remember: Good hygiene is like deodorant. When it’s working, nobody notices. When it’s not, everyone suffers.