SysAdmin Weekly #8: Security by Default? Still Optional... Apparently.
Patch madness, identity attacks, and a bonus Markdown template for postmortems. Just another week in the trenches!
⚡ TL;DR — This Week in SysAdmin Reality
· 🔐 130 new Microsoft vulns. Patch fatigue is real, but so are the exploits.
· 🎧 This week’s podcast: SaaS Cyber Kill Chains, and identity attacks…Yikes.
· 🛠️ Terraform meets GitHub Copilot in a smart AI-assisted lab build.
· 📘 DNS fundamentals, because everyone thinks they understand DNS… until they don’t.
· 🗂️ Bonus template: Markdown postmortem template to help you document outages like a boss.
🧠 This Week’s Insight(s) from Andy
After reading our curated links and resources this week, it seemed apt to make this week’s theme: “Security by Default? Still Optional… Apparently.”
Why? This week’s news is a chef’s kiss sampler of everything that still feels slightly broken in 2025: 130 patched vulns in one Patch Tuesday, more SaaS identity fire drills, and vendors slow-walking disclosures while CISA is out here yelling “exploit active, fix your stuff.”
On the other side of the spectrum, we’ve got smart sysadmins talking, and learning fundamentals (DNS!), experimenting with AI-assisted Terraform, and finding ways to run LLMs locally on OpenSUSE Tumbleweed via Ollama! Chaos and brilliance, side by side, which if I’m honest, is just another week in tech.
When I set out to create this newsletter, I wanted to make sure I included some security stuff, but by no means have it consume the newsletter. I feel like every week, a little more security content sneaks in, but with good reason! There is important and actionable info in the security space for SysAdmins EVERY week it seems!
One could make the argument that on large, highly-siloed enterprise teams, the role of security is often separate from the “SysAdmin”. I challenge that notion not only because not EVERY SysAdmin is on an enterprise IT team, but because the role of security is INCREASINGLY becoming an everyone responsibility. And, while security may not be the main focus in the SysAdmin role within a given organization, I emphatically believe that SysAdmins have a responsibility to both deploy and operate in a secure manner.
So, the next time you feel like grumbling, remember you’re not alone. We’ve all faced:
· 📢 Security team ping-ponging you on policy
· 🧨 Yet another zero-day needing urgent patching
· 🙃 Users doing “creative” things with their credentials
· 🚨 Vendors quietly leaking customer data again
· 🧠 The 4,995 other sysadmin pain points…
Remember… you may be the one-man (or woman!) army standing between threat-actors and your business data. Or, you may be in the trenches with a team doing the same. In either case you’re bringing VALUE to your organization whether they realize it or not. Find the measurable success in your efforts, document it, and shout it from the rooftops for all (especially the C-Suite!) to hear.
And now, back to our regularly scheduled programming….
🎹 The Latest on the SysAdmin Weekly Podcast
🎧 The SaaS Cyber Kill Chain
Andy and Paul take a look at how the cyber kill chain has evolved in a cloud-first, SaaS-heavy world. Identity is the perimeter, tokens are the targets, and persistence techniques are getting wild. If you manage SaaS apps, you’ll want to catch this one.
🎧 In Case You Missed It on SysAdmin Weekly
🎧 Microsoft’s SFI Moves: Are They Serious About Security Yet?
A look back at Microsoft’s Secure Future Initiative and whether Redmond is walking the talk or just rebranding security basics as groundbreaking progress.
🎧 Sneak Peek of the Next Episode
In our next episode, Eric and Andy sit down to revive an age-old debate in Hyper-V circles. Hypervisor in the domain, or not? There are pros and cons to each….. and maybe even a secret option C! That said, the guys both clearly landed on one side of the fence. Be sure to check that out coming later in the week on the SysAdmin Weekly Podcast!
🔍 From Andy On Tech and Project Runspace
📄 Understanding the Two VM Licenses with Windows Server Standard
Eric breaks down the often misunderstood VM rights included in Windows Server Standard. A great refresher (or first-timer explainer) for those planning small-to-mid hypervisor deployments.
📄 Azure Local: What Is It and Why Should SysAdmins Care?
If you’ve seen the term “Azure Local” floating around and thought, “Is this just marketing fluff for on-prem Azure?” you’re not alone. In this post, I break down what Azure Local actually is, where it fits with other Azure Edge solutions, and what it means for sysadmins juggling hybrid environments.
🧱 Core Fundamentals
📘 What is DNS?
Cloudflare delivers a clean, beginner-friendly explainer on DNS, perfect for folks just starting their SysAdmin journey or those of us who’ve set it up a thousand times but still quietly fear reverse lookups in our sleep.
🩵 Helpful Community Content
🧠 Why You Should Set Up Terraform MCP Server with GitHub Copilot
This blog post from Thomas Thornton seemed like an apt follow up on our Agentic AI and GitHub Copilot themes from the last few Podcast Episodes, Thomas gives a solid breakdown on pairing Terraform MCP server with GitHub Copilot for streamlined IaC deployments.
🌐 Build a Hub and Spoke with Azure’s Virtual Network Manager
Aidan Finn shows us how to use Azure’s Virtual Network Manager to spin up a solid hub-and-spoke network. Great for those tired of deploying networks in the cloud and just…. hoping for the best.
🔐 The SaaS Kill Chain in Practice
Paul Schnackenburg (yep, again!) writes about the identity-driven tactics that attackers use in modern SaaS environments. TL;DR: credentials are the new rootkits.
🧵 Password Rotation Debate on r/sysadmin
Solid thread discussing NIST’s updated stance AGAINST regular password rotation. The community weighs in with agreement, compliance headaches, practical exceptions, and existential frustration.
🎟️ Other SysAdmin Content from Vendors and Official Publications
💻 Run LLMs Locally on OpenSUSE
The official OpenSUSE blog shows you how to deploy Ollama and run local LLMs using Tumbleweed. A great option for those who want the power of AI without sending everything to the cloud.
🔊 Security Headlines for SysAdmins
🩹 Microsoft Patches 130 Vulnerabilities
Patch Tuesday this month was a lot. Remote code execs, privilege escalations, and more. Prioritize the criticals and test carefully, it’s a minefield this month.
🚨 CitrixBleed 2 Now Exploited in the Wild
CISA says it’s go-time. If you’ve got NetScaler appliances, patch immediately. Citrix has been a little quiet, but the attacker chatter is anything but.
🔥 Fortinet FortiWeb RCE Exploits Go Public
Proof-of-concept exploits are now public for a pre-auth RCE affecting FortiWeb. If your appliance is exposed and unpatched, you’re on borrowed time and possibly pwned already.
🛠️ Tool of the Week
🗂️ WinDirStat
Sure, it’s not new. But when you need to hunt down that one 100GB folder someone swears “just appeared,” WinDirStat still delivers the goods. If you’ve got a solid FOSS alternative, hit reply and tell us!
Note: WinDirStat can be installed via WinGet.
🧠 Quick Win of the Week:
Don’t forget, WinDirStat also lets you export CSVs for scripting and tracking storage sprawl over time. Pair it with a scheduled task and you’re halfway to a poor man’s monitoring solution.
📄 Bonus Template: Outage Postmortem Markdown Template
Outages happen. What separates the chaos from the clarity is whether you document the aftermath like a pro. This template helps you break down what went wrong, what was done, and what can be learned, without digging through Slack threads, memory fog, or those 2 am post-it-notes you can’t read.
📥 Grab the Outage Postmortem Template via Andy’s GitHub Gist
Use it for internal reviews, status updates, or as ammo for the “why we need to fix this properly” conversation.
🧠 Fun Retro SysAdmin Fact
Back in 1992, IBM sold a ThinkPad… with a butterfly keyboard.
No joke. The keyboard folded out as you opened the lid, expanding to full size. It looked like origami for nerds and made typing on a small laptop actually tolerable — in the pre-chiclet era.
☕ Wrap-Up
Another week, another pile of patches, news, AI hype, and low-level sysadmin wizardry. If you learned something, forward this to a fellow IT warrior who’s probably still googling Citrix patches while sipping reheated coffee.
And as always: stay curious. Stay caffeinated. And keep showing the bots who’s boss.
Until next week,
__
Andy