This site practices
the doctrine it publishes.
The ITOps Intelligence™ series is written by a Certified Information Systems Security Professional (CISSP) who has led security operations across federal civilian agencies and the U.S. Navy. The site itself is designed to meet the same hardening standards the books describe.
Security philosophy
Defense in depth. Least privilege. Public transparency on what is protected and how.
This is a static HTML site. There is no server-side application, no user authentication, no data collection beyond voluntary newsletter and waitlist submissions, and no third-party analytics. The attack surface is minimal by design. What we have, we harden fully.
Edge architecture
www.itopsintelligence.com is served through Cloudflare's global edge network in front of a static origin on Namecheap shared hosting. Cloudflare handles TLS termination, HTTP security headers, Web Application Firewall (WAF), and bot/DDoS protection. Apache .htaccess and inline meta-tag headers remain in place at the origin as defense-in-depth.
This architecture delivers three controls the origin alone cannot:
- Edge-layer absorption — malicious traffic is handled at Cloudflare's anycast network before reaching the origin.
- Application-layer filtering (WAF) — signature-based inspection blocks SQL injection, XSS, and the rest of the OWASP Top 10 before requests reach the origin.
- DDoS absorption — volumetric attacks are mitigated at Cloudflare's scale, not the hosting tier.
Implemented controls
The following controls are currently enforced on every request to www.itopsintelligence.com:
| Control | Status | Implementation |
|---|---|---|
| Cloudflare edge proxy | Active | All traffic proxied through Cloudflare's global anycast network. Origin IP shielded. |
| Web Application Firewall (WAF) | Active | Cloudflare Managed Rules — OWASP Top 10 signature-based filtering at the edge. |
| DDoS protection | Active | Cloudflare unmetered DDoS mitigation (L3/L4/L7). |
| Bot Fight Mode | Active | Automated challenge for known bad bots and scraper signatures. |
| HTTPS enforcement | Enforced | All HTTP requests 301-redirected to HTTPS. TLS 1.3 preferred; TLS 1.2 minimum. |
| HSTS | Enforced | max-age=31536000; includeSubDomains; preload — submitted to the HSTS preload list for inclusion in Chrome, Firefox, Safari, and Edge. |
| Content Security Policy | Enforced | Strict default-deny. Frame-ancestors 'none'. Object-src 'none'. Base-uri 'self'. |
| X-Frame-Options | Enforced | DENY — no framing permitted under any circumstances. |
| X-Content-Type-Options | Enforced | nosniff — MIME-type sniffing disabled. |
| Referrer-Policy | Enforced | strict-origin-when-cross-origin |
| Permissions-Policy | Enforced | Camera, microphone, geolocation, payment, USB, and 20+ other APIs explicitly denied. |
| Cross-Origin-Opener-Policy | Enforced | same-origin — browsing-context isolation. |
| Cross-Origin-Resource-Policy | Enforced | same-site — cross-origin resource loading restricted. |
| Directory listing | Disabled | Options -Indexes — no directory enumeration. |
| Server fingerprinting | Suppressed | Server version, X-Powered-By, and similar fingerprint headers removed. |
| HTTP method allowlist | Enforced | Only GET, POST, HEAD, OPTIONS permitted. PUT/DELETE/TRACE denied. |
| Common attack pattern blocking | Enforced | Query-string SQL injection and XSS signatures rejected with 403. |
| Sensitive file paths blocked | Enforced | /.git, /.env, /wp-admin, /wp-login, backup extensions, dotfiles. |
| Hotlink protection | Enforced | Images served only to approved referrers (site itself + major search/social). |
Hash-based CSP (no 'unsafe-inline') |
Phase 2 | Current CSP permits 'unsafe-inline' for inline scripts/styles. Upgrade to SHA-256-hash-pinned CSP planned for the next hardening round. |
| Self-hosted fonts | Phase 2 | Currently loading from Google Fonts. Migration to self-hosted WOFF2 files planned to eliminate third-party dependency and improve privacy. |
Compliance alignment
The site's hardening controls map to published standards:
- NIST SP 800-53 Rev 5 — SC-5 (denial-of-service protection), SC-7 (boundary protection), SC-8 (transmission confidentiality), SC-13 (cryptographic protection), SC-23 (session authenticity); AC-4 (information flow enforcement); SI-10 (input validation); SI-4 (system monitoring, via Cloudflare analytics).
- OWASP ASVS 4.0 — V14 (Configuration) baseline controls.
- OWASP Secure Headers Project — All recommended headers implemented.
- CIS Controls v8 — 4.1 (secure configuration), 12.2 (application layer filtering, via Cloudflare WAF), 13.3 (centralized monitoring), 13.10 (DoS defense).
- ISO/IEC 27001:2022 — A.8.8 (secure development), A.8.22 (web application security), A.8.23 (web filtering).
- GDPR & CCPA — Minimal data collection; voluntary consent; privacy policy on file.
- Section 508 / WCAG 2.2 AA — Accessibility: substantially conforms, with known exceptions.
Edge provider compliance: Cloudflare maintains SOC 2 Type II, ISO 27001:2022, ISO 27701, ISO 27018, and PCI DSS Level 1 attestations for the services used by this site.
Responsible disclosure
If you discover a vulnerability or configuration issue affecting this site, please report it responsibly.
- Send the report to [email loading] with sufficient detail to reproduce the finding.
- Allow a reasonable window for investigation and remediation before public disclosure.
- Do not exfiltrate data, execute denial-of-service, or degrade service availability during testing.
- We acknowledge verified reports in writing and, where appropriate, credit the reporter in public remediation notes.
No bug bounty program is currently offered. All disclosures are volunteer-basis. Verified findings that materially improve the site's security posture will receive written acknowledgement and credit.
Machine-readable policy
Per RFC 9116, a security.txt file is published at /.well-known/security.txt with canonical contact and policy references.
What is not collected
The site explicitly does not:
- Track visitors with third-party analytics (no Google Analytics, no Facebook Pixel, no Hotjar, no Mixpanel).
- Set advertising cookies or share data with ad networks.
- Require login or maintain user accounts.
- Process payments on-site (commerce flows redirect to Gumroad / Printful / KDP).
- Expose server-side code or databases (site is 100% static HTML).
What is collected — on voluntary submission only — is limited to email addresses provided via the newsletter and book waitlist forms. See Privacy Policy and Cookie Policy.
Contact
For security-related correspondence:
For general correspondence:
Published by TMG Global Service, Inc. · ITOps Intelligence™ is a pending US trademark.