Search hans.study
Indexed across articles, news, KB updates, knowledge base, books, learning, and tools. Press Esc to close.
// ABOUT HANS STUDY · INDEPENDENT NETWORK AND SECURITY CONSULTANT
I'm an independent network and security consultant based in Ontario, Canada, working with clients across Canada and the United States. I work as a fractional CISO and strategist for defence suppliers, critical infrastructure, public safety, and regulated organizations. The work is boutique: security leadership and strategy, enterprise networks, OT and ICS, controls and security systems, and the infrastructure underneath them, with a focus on defence supply chain compliance and the OT, IT, and physical security convergence boundary. Microsoft Windows, Cisco, Aruba, and Genetec Security Center are my primary stacks. Federal, defence, law enforcement, public safety, critical infrastructure, and enterprise.
Controls, security, and critical infrastructure. Small portfolio, deep engagement, no time spent juggling a hundred unrelated accounts. The work fits where the stakes are high and the cost of getting it wrong is real.
Greenfield and brownfield. Topology, segmentation, routing, wireless, and security architecture. Camera, access control, and intercom systems specified for the environment rather than copied from a previous job.
The systems that should work but do not. Cross-vendor integration issues. Performance and reliability problems that nobody else has been able to nail down. Pre-RFP technical review and owner representative work during deployment.
Windows server and workstation baselines. Switch and firewall hardening. Genetec deployments where Defender exclusions and service accounts have to be exactly right. Tuning for VMS and access control workloads under audit.
Free, time-permitting. Junior practitioners moving into network or security work, integrator teams bidding their first complex project, and IT generalists handed a Genetec environment they did not design. Asynchronous over email when that fits, scheduled calls when the question is bigger.
A quick filter before you book a call.
Hardening, baselines, Active Directory design and tiering, Defender tuning for VMS and access control workloads, Group Policy at scale.
IOS, Catalyst 9000 series, ISE. Routing, switching, and the security tracks taught at the post-secondary level.
AOS-CX and CX switching. ClearPass on the policy side. Field-experienced in deployments where Aruba is on the bill of materials.
Architecture, deployment, troubleshooting. Directory, Archiver, Synergis, ConfigTool, Security Desk. The reference platform for VMS work on this site.
Axis, Bosch, Milestone, Avigilon, C-CURE 9000, Fortinet, Palo Alto, Juniper EX, and Alcatel-Lucent OmniSwitch. Selected when they are the right fit for the deployment.
I started the way a lot of people in this field do. Fixing computers for friends and family in the early 2000s. A part-time job at a local computer shop installing small business networks and CCTV systems. By 2010, that had grown into my own IT firm. I built and sold an earlier security practice in the years that followed.
What followed over the next fifteen years is where the depth comes from.
I have spent my career working across public sector, defence, public safety, and critical infrastructure environments, designing and integrating the technology those organizations depend on. That includes years on federal mission-critical networks, where operational continuity was a daily responsibility, not a theoretical goal.
What keeps me in the work is curiosity. I take systems apart to understand how they function, push security controls to their limits, and apply the lessons to stronger designs. Same approach to work, play, and hobbies. That habit shapes how I approach both digital and physical security today.
That curiosity also pushed me into developing technical courseware and educational content, and into teaching at the post-secondary level as an associate professor. The courses ran Cisco CCNA, Introductory and Advanced Networking, Information Security, and Microsoft Windows Server and Workstation. Hundreds of students went through them. Teaching is where you find out how well you actually understand something. You cannot fake it when someone asks you to explain why, not just how. The courseware work continues through the Study Learning programme. The teaching was one chapter of it.
I'm the author of The Study Guide series, a practitioner-focused book series for networks, physical security, and the integration problems that sit between disciplines. 3 titles are currently available:
Additional volumes are in development. Available on Amazon.
CISSP, from ISC2, is the credential I hold and keep current. A certification does not tell you whether the person can do the work, so the rest of this section is platform experience from 15 years in the field.
I took the courses, sat the exams, and did the work. CISSP is the one credential listed on this site. The priority has been doing the work, teaching it, and writing about it.
The teaching is worth highlighting separately. I taught Cisco CCNA, Introductory and Advanced Networking, Information Security, and Microsoft Windows Server and Workstation at the post-secondary level for multiple years. Hundreds of students went through those programs. That is a different kind of credential than a paper cert. It is the credential of having to explain the material to people learning it for the first time, every term, in a way they can actually use.
I advise organizations operating under:
Compliance work is not about applying frameworks as written. It is about helping organizations understand what each framework actually requires, given the technical and organizational constraints they are already operating under.
I work independently. No equipment sales, no margin on anything specified, no commission. The independence policy sets out what that covers. The recommendation reflects what the environment requires. That is the only thing it reflects.
I have presented on cybersecurity resilience and infrastructure security at industry conferences and events.
The Articles at hans.study/articles/ is my working library of technical articles on switch hardening, Windows server hardening, Genetec deployment, OT and ICS security, and integration practices for security networks. The Knowledge Base at hans.study/standards-guidance/ is the reference library: vendor configuration templates, the Canadian Security Install Reference series, and the standards work that informs day-to-day field decisions. The StudyByt3s podcast covers the work that sits between IT, physical security, and OT, in the format of a conversation rather than a tips-and-tricks show.
Practitioner-grade utilities at hans.study/tools/ back up the writing. Switch configuration generator, Windows hardening script generator, subnet calculator, conductor and BOM calculator, SCHANNEL crypto config. Each one is a tool I needed at some point and decided was worth building properly.
The tools I use on engagements are public on GitHub, each with a page here that explains how it works.
Based in Ontario, Canada. Engagements span Canada and the United States. Federal, provincial, municipal, and private sector. Virtual and on-site. The sectors page lists the government, public safety, critical infrastructure, transportation, and multi-site work.
If you landed here looking for the short answer to "who is this and what do they do," there is a focused entity card at Who is Hans Study?
The person you hire is the person who does the work. That is the whole arrangement, and it is worth stating plainly because it is not how most of this industry operates.
Sole practitioner. Part-time help comes in per engagement when the work needs it, for site walks, configuration pulls, evidence and log collection, device inventories, scheduling, and documentation. That exists so my attention goes to the parts that need it. What never happens is somebody else's judgement being sold under my name. I do the looking, the analysis, and the conclusion, and I am the one you talk to about it.
Practically, that means capacity for multi-site work, without the arrangement where a senior name wins the engagement and a junior delivers it. It also means honesty about availability. If a timeline does not work, you will be told that rather than handed to someone else.
Nothing is sold here except the advice itself. No hardware, no software, no installation, no commissions. The independence policy sets out exactly what that covers and what it costs.
Writing and listings on sites I do not control, which is the part that counts.
For project work and general inquiries, send a note via the contact page or directly to contact@hans.study. For book questions, review copies, errata, or bulk orders, use book@hans.study. For media, podcast, and speaking inquiries, reach out at media@hans.study. Mentorship is free and time-permitting; the form on the mentorship page is the right starting point for that.
Two tools run by default to help me understand how the site is used. You can turn either off at any time. Cloudflare's server-side analytics is always on and never sees your identity.