The Security Brutalist’s Guide to Basic Security Hygiene

No Frills. No Excuses. Just Discipline.

Security Brutalism rejects the endless pursuit of buzzwords, dashboard overload, and the 47 overlapping tools that flood you with identical non-alerts. Instead, it focuses on doing the hard, simple things well, repeatedly, until they become muscle memory.

Here's your no-BS guide to basic security hygiene, brutalist-style.

1. Patch Like a Maniac

Patch critical vulnerabilities within days, not months, and automate the process wherever you can. Track what slips through so nothing sits forgotten. Ransomware doesn't wait for your next quarterly change window, and any internet-facing system that's unpatched should be treated like it's already compromised.

2. MFA or GTFO

Enforce phishing-resistant MFA on all access, especially email, VPNs, admin panels, and production systems. Passwords are lies we tell ourselves, convenient until the moment they aren't. If a system can't support MFA, isolate it like a biohazard.

3. Kill Local Admin Rights

Strip end users of local admin rights, full stop. Malware loves privilege more than hackers do, and every unnecessary admin account is one more door left open. Your executives don't need admin rights to open PowerPoint.

4. Log Like You Mean It

Centralize and retain logs for key systems, and monitor for anomalies rather than waiting on alerts alone. If something isn't logged, it didn't happen, or worse, you'll never know it did. Build your detections as if you're under attack right now, because eventually you will be.

5. Backup Like a Paranoid Historian

Keep backups regular, encrypted, tested, and stored offsite or immutable. Backups are your last line of defense, so they can't be allowed to fail the way your first five lines of defense sometimes do. Test restores quarterly. A backup that hasn't been tested is just a liability wearing a backup's name.

6. Least Privilege, Everywhere

No user, process, or system should get more access than it absolutely needs. Flat networks and overprivileged accounts turn into hacker playgrounds fast. Design access as if you distrust everyone, because you should.

7. Security Training That Doesn't Suck

Ditch the click-through eLearning and run live demos instead, teaching real threats and showing real consequences. People remember stories, not slides. Social engineer your executives once a year, share the scoreboard, and make no exceptions for rank or title.

8. Inventory or Die Trying

Know what you own: assets, SaaS, APIs, endpoints, rogue printers, all of it. You can't secure what you don't know exists. Build automation that flags surprises, since surprises are where breaches begin.

Final Word from the Brutalist Playbook

Security hygiene isn't glamorous and it isn't sexy. It runs on repetition, constraint, and discipline, like sharpening a blade through small, deliberate strokes every damn day.

Patch your crap, kill your admin rights, and back up like your job depends on it, because it does.

Good hygiene works like deodorant. When it's working, nobody notices. When it's not, everyone suffers.