Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Securing the operating systems you already run

Three published baselines exist and they disagree with each other on purpose. Picking one and applying a subset beats reading all of them and applying none, which is what usually happens.

For. Whoever owns the build, in an estate that is already deployed

  1. 01

    Pick one baseline, and pick it for a reason

    minutes

    Microsoft Security Compliance Toolkit is the least disruptive and updates roughly annually. CIS sits in the middle, updates quarterly, and has Level 1 and Level 2 profiles precisely so you can take the safe half. DISA STIG is the most aggressive and updates most often, and it is written for an adversary most organisations do not have. Choose on what you can operate, not on what sounds strongest.

    how to know it workedWrite down which baseline and which profile level, where anyone can find it. A baseline nobody can name is a baseline nobody is measuring against.

  2. 02

    Measure before you change anything

    an afternoon

    Run the baseline in audit mode across a representative sample. Intune can assess against STIG read-only, and CIS-CAT and the Microsoft toolkit both report without enforcing. You are looking for the gap, not the score.

    how to know it workedA report you can diff against a later one. Without a starting number, nothing you do afterwards can be shown to have worked.

  3. 03

    Take the logging settings first

    an afternoon

    Every baseline includes audit policy, and it is the subset with no user-visible effect: nothing breaks, nobody notices, and every later investigation is better. Command-line capture on process creation and PowerShell script block logging are the two that change the most.

    how to know it workedTrigger the event and look for it. Run a distinctive command and confirm 4688 carries the arguments; run a PowerShell block and confirm 4104 holds the text. A policy that is set and not producing events is the normal failure.

  4. 04

    Then the credential and lateral movement settings

    a project

    LSASS protection, disabling WDigest, restricting local account use over the network, and SMB signing. These are where a single compromised workstation stops being the whole domain, and they are the ones with real breakage risk, so they go through a pilot ring.

    how to know it workedAttempt the thing you have just stopped, from a machine you control and with permission. A control nobody has tested against is a belief.

  5. 05

    Decide what you are not doing, and write that down too

    an afternoon

    Every estate has settings it cannot take: a line-of-business application that needs an old protocol, a lab that cannot be joined. An exception with an owner and a review date is a managed risk; the same exception undocumented is a hole somebody will find in an audit and treat as negligence.

    how to know it workedThe exception list is reviewed on its date rather than when somebody remembers. Same discipline as a detection suppression, and it fails the same way.

what this does not cover

  • Anything an attacker does with valid credentials, which is most of what they do. A hardened host still opens for somebody who logged in
  • Applications, which are usually the way in and are governed by their own configuration rather than the OS baseline
  • Devices that never receive policy: the unmanaged laptop and the forgotten server are exactly where the gap is, and a compliance percentage counts only what it can see