Strategic consulting on zero-trust architectures, regulatory compliance (NIS2/DORA) and incident response.
The five most recent articles authored by Thomas Joos on this topic – straight from trade publications.
Serial-to-IP converters, time clocks and medical gateways as new attack surfaces. Microsegmentation per IEC 62443, enforcement points at device level, lessons from the attack on the Polish energy sector.
Routers top the list of riskiest IT devices. 75 percent of today’s critical device classes were absent two years ago. PSIRT, CISA KEV, EPSS and ISAC feeds as prioritisation basis.
Mandiant M-Trends 2026 reveals that initial access brokers and affiliate groups automate their workflows. Manual defence has little chance at this cadence.
Sniffnet, OpenVAS, ELK stack, Zabbix and StackStorm combined into automated AD monitoring. Detection, analysis and response without vendor lock-in.
UEFI-based Secure Boot validates firmware, bootloader and pre-boot modules. Admins must initiate certificate renewal themselves – risks and paths.
A brief overview of the most common engagement types. Concrete contents remain confidential – described is only the activity.
Assessment of hardening, replication and privileged access – often ahead of audits, KRITIS reviews or a planned vendor change.
Roadmaps, prioritisation and ongoing reviews for NIS2, DORA, KRITIS-V2 and zero trust implementations.
Discussion and evaluation of current threats – edge hardware risks, ransomware strategies, AI-assisted defence.
Architecture analysis after security incidents, deriving lessons learned and building a hardened follow-up architecture.
IT-OT segmentation per Purdue model and IEC 62443, Active Directory in production networks, asset registers, microsegmentation and secure integration of control systems.
Annual cyber damage for the German economy
Share of companies hit by ransomware in twelve months
Share of affected companies that paid ransom
The threat landscape forces a resilience strategy beyond classical backup concepts. Cyber insurers now require proof of non-manipulable backup states as a condition for coverage. Storage-level immutability becomes mandatory and replaces application-side solutions.
Deep dive in the article: SBOM: from regulatory constraint to cornerstone of software securityIn security and critical-infrastructure projects I cover three topics individually: resilience strategy instead of pure recovery planning, storage-level immutability instead of scattered point measures, and an architecture that holds up to regulators, insurers and auditors. Every organisation receives its own maturity assessment based on the existing infrastructure.
IT and OT systems are merging. In 2024 nearly 70 percent of industrial companies recorded an attack on their OT systems, a quarter had to halt operations. Control systems built for decades of service meet a threat landscape that did not exist when they were designed.
I advise on the questions that decide the security of these environments: IT-OT segmentation along the Purdue model and IEC 62443, the role of Active Directory in production networks, complete asset registers, microsegmentation down to device level and the secure integration of serial-to-IP converters and edge bridges.
Modern ransomware campaigns hit production systems and backups alike, often compromising the backup first. Protection at the network edge and in backup software no longer suffices. The defence moves to where the data lives.
I advise on immutability at the API level via Object Lock in compliance mode, end-to-end encryption, versioning and recovery. Even a compromised backup admin cannot lift the lock. Cyber insurers increasingly require this configuration as a precondition for the policy.
Review of the attack surface, immutable backups and resilient recovery paths before an incident.
Hardening the identity layer before audits and after the NTLM phase-out in hybrid environments.
Design and implementation of current security architectures following the "Never trust, always verify" principle.
Development of compliance roadmaps to meet the new EU directives for cybersecurity and digital operational resilience.
Specialised security concepts for operators of critical infrastructure (energy, healthcare, financial sector).
Structured post-incident analysis, forensic support and safe recovery planning after cyberattacks.
Architecture consulting to preserve data sovereignty and independence in cloud and hybrid environments.
Once inside the network, you are trusted. After a breach, an attacker moves freely.
Every access is verified, regardless of location. Identity, device and context decide each connection.
Build internal know-how. My training courses prepare your IT team to detect and counter current threats.
Praxisnahe Techniken zur Analyse von Netzwerkverkehr und Identifikation von Sicherheitslücken.
Härtung und Absicherung Ihres Windows Server 2022 Systems gegen aktuelle Cyberbedrohungen.
„After our last audit it was clear that we needed to significantly catch up on hardening our Active Directory infrastructure. With Thomas Joos we made measurable progress in a KRITIS-compliant manner. Above all, the methodical approach and the documentation level convinced our compliance team."
„Your articles are among the most-read on the entire site. First of all, I would like to praise you for your Patch-Tuesday reports. The 39 articles I have published from you this year have together generated an enormous number of page impressions. That is an outstanding result, for which I give you great praise and thanks."
„Peter Schmitz, Editor-in-Chief at Security-Insider, likes the texts – no changes needed. Thanks for handling it so quickly."
„I read the Security-Insider news regularly. The Patch-Tuesday summary is informative, alarming and reassuring at the same time. The information is correct and important, and the summary is simply brilliant."
For every focus area I provide in-depth expertise instead of buzzwords. The articles show what I work on in projects and which requirements enterprises must clarify now.
Practical guide based on NIST specifications. How enterprises introduce Zero Trust in a structured way instead of just using buzzwords.
Current threat research shows: traditional defense no longer suffices. AI-based detection and response become the baseline.
Manufacturers of connected products face clear EU duties. What the CRA actually requires and which lead time enterprises need.
Software Bills of Materials become mandatory. How SBOMs make supply chains transparent and surface vulnerabilities early.
Sniffnet, OpenVAS, ELK stack and Zabbix combined for real-time AD monitoring. Detection, analysis and response without vendor lock-in.
Mehrere Internetanschlüsse erhöhen die Ausfallsicherheit einer Firewall deutlich. OPNsense bündelt dafür mehrere WAN-Schnittstellen in Gateway-Gruppen und steuert den Datenverkehr über Policy Routing. Die vollständige Konfiguration gelingt in fünf aufeinand…
Read articleEine kritische Lücke in der selbst gehosteten Git-Plattform Gogs gibt jedem angemeldeten Konto Rechte zur Remote Code Execution auf dem Server. Ein öffentlich verfügbares Metasploit-Modul automatisiert den Angriff in Sekunden. Version 0.14.3 behebt die …
Read articleTrotz Datenschutzregeln vergeht zwischen der Kenntnis eines Datendiebstahls und der Benachrichtigung der betroffenen Personen immer mehr Zeit. Jüngste Vorfälle zeigen Verzögerungen von über sechs Wochen, obwohl die gestohlenen Daten längst öffentlich kursi…
Read articleI have written texts and analyses on NIS2, CRA, KRITIS, digital forensics and cybersecurity. See my publications.
