Classification: Ingress Hardening & Attack Surface Reduction
Status: Implemented & Verified

Executive Summary

This report documents the architectural lifecycle of container management on Bastion: from initially deploying a web-based GUI (Portainer) to overcome early CLI friction, to identifying the inherent security risks of host-socket mounting, and finally decommissioning the interface in favor of key-authenticated, terminal-native tooling (lazydocker).

Phase 1: Initial Deployment & Context

Why Portainer Was Introduced

When initially transitioning to Docker and container orchestration, early CLI management presented significant friction. Debugging multi-container networks, diagnosing container start failures, and managing persistent volume paths purely through raw shell commands often led to silent errors and operational overhead.

Classification: Perimeter Defense & Mail Authentication
Status: Implemented & Verified

Executive Summary

This report covers auditing, remediating, and enforcing cryptographic and domain-level email authentication records (SPF, DKIM, and DMARC) across a multi-service custom domain. The objective was resolving silent delivery failures for automated application notifications, aligning third-party transactional mail providers, and enforcing a strict quarantine policy to protect domain reputation against spoofing and phishing attempts.

Threat Model & Problem Statement

When operating self-hosted services alongside third-party transactional email relays and professional mail routing, misaligned authentication headers lead to two major failure modes:

Classification: Digital Sovereignty & Identity Threat Modeling
Status: Implemented & Verified

Executive Summary

This report details the execution of an identity attack surface reduction campaign. By systematically auditing third-party service dependencies, invoking statutory Data Subject Requests (DSR / “Right to be Forgotten”), and deploying automated data broker removal pipelines, legacy identity sprawl and third-party data exposure risks were remediated.

Threat Model: Third-Party Exposure Footprint

Security perimeters extend beyond host firewalls into third-party SaaS platforms and data aggregation brokers: