Notes on infrastructure and security
Short notes from the MyIT Cyber team on the systems we build, secure, and run every day. Written for IT leaders and decision makers, with no marketing fluff.
Docker Compose Does Not Automatically Use the GPU
On Linux GPU servers, Docker Compose does not use the NVIDIA GPU automatically. The service starts, nothing obviously fails, and the workload quietly falls back to CPU. The fix is a few lines in the compose file, but only if you know to look for them.
Docker Default Runtime: Keep GPU Containers on NVIDIA
On Linux GPU servers, Docker can know about the NVIDIA runtime and still not use it. If default-runtime is missing from daemon.json, every container falls back to runc, nvidia-smi fails inside the container, AI workloads drop to CPU, and the problem looks like an application issue when it is really a one-line configuration gap.
API Security: Do Not Trust the Client
The frontend can hide buttons, disable fields, and guide the user through the right flow, but anything that comes from the client can be changed. Attackers swap IDs in URLs, edit payloads, call the API directly, and bypass the UI completely. Real security lives in the backend: authentication, authorization, object-level access checks, input validation, rate limits, and logging on every request, because every request is treated as possibly manipulated.
Certificate Expiration Is Still Taking Systems Down
An expired certificate is one of the simplest, most preventable outages, and it still keeps happening. The fix is not heroics on renewal day. It is treating certificates like production assets: a real inventory, a clear owner, monitored expirations, alerts, a renewal process, automation where possible, and post-renewal testing so the change does not break something downstream.
GraphQL: Powerful, Flexible, and Easy to Misuse
GraphQL gives clients a clean way to ask for exactly the data they need from a single endpoint. That same flexibility is also what makes it easy to over-expose. Without field-level authorization, query depth and complexity limits, rate limiting, logging, and a real schema review process, one badly shaped query can return information a user should never see, or quietly knock the backend over.
Your Firewall Should Not Be Your Only Security Strategy
A strong firewall matters, but a strong firewall protecting a weak interior is still a weak environment. Old servers, weak passwords, over-permissioned users, unmonitored endpoints, untested backups, and flat networks do not stop being problems just because the perimeter is solid. Real security comes from layers, segmentation, MFA, patching, least privilege, endpoint protection, logging, backups, and incident response, all running together.
Break Glass Accounts: Necessary, but Dangerous
Every organization needs a backup plan for access. When identity services are down, MFA is broken, or the regular admins are locked out, break glass accounts are how the company gets back in. The same accounts are also a dream target for attackers, which is why they need strong credentials, safe storage, limited ownership, monitoring, alerts on use, and a real review cadence, not a sticky note in a drawer.
Local Admin Rights Should Not Be Permanent
Privileged access is not only a cloud problem. While most security work focuses on admin roles in Microsoft 365, cloud platforms, firewalls, and servers, the local admin rights sitting on every laptop are often quietly forgotten. Endpoint Privilege Management replaces permanent local admin with controlled, per-app, time-limited elevation, so users keep working without the endpoint becoming the soft underbelly of the environment.
Privileged Identity Management: Admin Access Should Not Be Permanent
Admin access is one of the most sensitive things in any organization, yet many companies still treat it as something permanent. Permissions are granted and quietly stay. Privileged Identity Management flips the model, admin rights are requested when needed, approved, MFA-enforced, time-limited, logged, and reviewed. The goal is not to make work harder. It is to make admin access controlled, visible, and temporary.
The Forgotten Server Is the Real Risk
Every company has the systems everyone talks about, the firewall, the main servers, the cloud, the VPN, the backup platform. The real risk usually lives somewhere else: the old server nobody wants to touch, the test machine that became production, the legacy NAS, the camera system with an ancient password, the application that still works but has no owner. The problem is rarely technology. It is ownership.
AI Storage: Why Fast GPUs Still Wait for Data
In AI infrastructure, the real bottleneck is often not the GPU, it is the storage. When data does not arrive fast enough, expensive GPUs sit idle. A well-designed NFS setup is still a great starting point for many AI workloads, and jumping straight to block storage usually buys complexity before it buys performance. The better question is which storage matches the workload the team can actually operate.
RDMA: Why It Matters for AI Infrastructure
Modern AI workloads run across many GPUs, many servers, and large datasets. At that scale the network is just as important as the compute. RDMA lets one server access memory on another with very low latency and minimal CPU involvement, so GPUs can spend time on math instead of waiting on the network. It is not a checkbox, but it is the difference between a fast GPU cluster and an expensive one that is mostly idle.
Firewall Rules: Clean Rules Are Safer Rules
Firewall rules are easy to create and much harder to maintain. Over time the rule base fills up with old projects, temporary access that never expired, wide ranges, stale objects, and rules nobody fully understands anymore. Clean rules, with owners, business justification, expiration dates, hit counts, and a review cadence, are not just tidier. They are measurably safer.
Network Segmentation: Do Not Put Everything on the Same VLAN
Network segmentation is one of the most basic security principles, and one of the most ignored. Flat networks are easy to build but easy to abuse, one compromised endpoint can reach far too much. Whether it is VLANs on-prem or subnets, security groups, and private endpoints in the cloud, every system should only talk to what it really needs.
Backup Policy: Local, Cloud, and the 3-2-1 Rule
Owning a backup tool is not the same as having a backup policy. A policy says what is protected, how often, where copies live, who is responsible, and how restore is tested. The 3-2-1 rule, combined with local and cloud copies, is still the simplest way to make sure one failure does not take the business down.
PCIe 5.0 for GPUs: Speed Matters, but Design Matters More
PCIe 5.0 x16 gives a GPU around 64 GB/s of bandwidth in each direction. That is impressive on paper. What actually decides whether a Local LLM stays stable under hours of load is power, cooling, lanes, drivers, firmware, and the real workload, not the PCIe version on the spec sheet.
NVIDIA CUDA in Containers: Version Alignment Matters
Running GPU workloads in Docker or Kubernetes is powerful, but most outages are not in the application. They come from small mismatches between the host driver, the CUDA libraries in the image, the Container Toolkit, and the Kubernetes node config. Stable GPU environments start with version alignment.
NinjaOne RMM: Why Intune Is Not Always Enough
Intune is a strong platform for policy and device compliance. It does not always cover the day-to-day operational reality. RMM platforms like NinjaOne add monitoring, automation, patching, and remote support so IT teams stay ahead of incidents instead of behind tickets.
Proxmox: When Cost Forces a Real Infrastructure Decision
VMware is still an excellent, mature platform. But the price has changed the conversation. For many organizations, moving to Proxmox is no longer about replacing something bad with something better. It is about making infrastructure decisions that also make financial sense.
Secrets Management: Stop Saving Passwords in Code
Saving passwords, API keys, or tokens inside code feels quick, but the moment they hit a repository or CI pipeline, they are not really private anymore. Code defines what the application does. Secrets should never live inside it.
SSH Keys: A Better Way to Access Linux Servers
Many Linux servers still rely on a username and password. SSH key authentication is more secure, easier to manage, and removes passwords from the wire. For production servers, password-based SSH should not be the default.
AI Permissions: Your AI Should Follow the Same Rules as Your Users
If an employee cannot open a financial document, the AI should not show them that data either. AI does not remove the need for identity, role-based access, and audit logs. It makes those controls more important.
AI Agents: More Than Just a Chat
AI chat is where many companies start. AI agents are where AI becomes part of real work, reading documents, checking logs, searching tickets, and helping teams complete tasks instead of just talking about them.
Shadow AI: The New Risk Inside Organizations
Employees are already using AI at work. When IT does not know which tools, what data, or where the conversation history lives, that is Shadow AI. The fix is to give people a safe, approved path, not to block the only tool that gets the job done.
RAG: Good Answers Start With Good Data
RAG lets AI search company data before answering, but if that data is messy, outdated, or wide open, the AI will return confident wrong answers. Good RAG starts with good data, clear ownership, and the right security model.
Local LLM: Why It Is Worth the Time and Resources
Cloud AI is easy, but it is not always the right answer when the data needs to stay inside the company. A local LLM gives IT and security teams a way to use AI on internal systems without handing sensitive data to an external service.
ZTNA: A Better Way to Secure External Access
Forcing VPN for every cloud service is no longer the right model. ZTNA gives IT teams a cleaner way to secure email, SaaS, and admin portals with identity, device posture, and policy-controlled access paths.
Why You Should Delete the Default AWS VPC
The default AWS VPC is fine for kicking the tires. For a real company environment, it is too open, too generic, and too easy to misuse.
Why Windows Servers Need MFA for RDP Access
MFA on email and VPN is standard. On Windows Server logins, it usually isn't. That gap is where most of the trouble starts.
Plug our knowledge into your AI
Our Insights catalog is a public Model Context Protocol server. Claude Desktop, Cursor, Continue, and any MCP-compatible client can connect and use our notes on IT infrastructure, security, AI, and cloud as a trusted source, with citations back to this site.
{
"mcpServers": {
"myit-cyber-insights": {
"url": "https://myitcyber.com/api/mcp"
}
}
}