FAQ

Authentication. Either using some pre-shared secret that hasn't been written down, or using a dedicated mutual authentication system.

Patching alone often isn't sufficient. Good security practices reduce attack surface on multiple planes and using multiple techniques. High level areas include:

1. Principal Of Least Privilege -- grant the bare minimum necessary for a component to perform its job.
2. Deny By Default -- an extension of least-privilege, where possible, deny entities and operations by default and only allow where necessary.
3. Defense In Depth -- Apply your security policy to all components, not just the public facing ones. Assume that Internet-facing systems will be compromised and that more sensitive systems can't blindly trust them.
4. Remember The People -- In many organisations, the people are a significant attack surface through Social Engineering attacks. Include easy-to-follow processes for humans, such as Mutual Authentication, to protect humans from Phishing and AI Deepfake attacks.
5. Store Nothing -- If there's no sensitive data stored, there's nothing to be stolen. Obviously this isn't always possible, but with the maturation of Local-First technologies such as Zero Knowledge Proofs, many systems could be designed to store much less sensitive data than they do today. Digital ID Done Less Badly gives some more detailed examples.

Securing Against The Robots contains more detail and further pointers.