Defensive Security Handbook, 2nd Edition

Chapter 10. Microsoft Windows Infrastructure

While it may be the bane of every security professional’s existence, Microsoft Windows is being used in public and private infrastructures, both small and large, across the world. It is by far the most widely used operating system and also the most commonly misconfigured. Misconfigurations in Microsoft operating systems and software contribute to a huge number of security issues and compromises. The Exploit Database currently lists over 10,000 exploits running under the Windows platform (compared to 8,000 when the first edition of this book was published). 

Microsoft covers a staggering number of verticals, but in this chapter we’ll stick to where it comes into play in the enterprise environment and the biggest bang for your buck in terms of security. We’ll cover some quick wins such as moving away from older operating systems and turning off open file sharing, as well as in-depth best practices regarding Active Directory. Taking these few steps will significantly decrease your attack surface and increase your detection capabilities (and also might help you sleep better at night¹).

Quick Wins

There are a few standard no-brainers that we should get out of the way at the beginning.

Upgrade

The first and most obvious quick win is upgrading endpoints to a supported operating system. While some corporations are still struggling to move off of Windows 7 and Windows XP (and, shockingly, even older operating systems), the threats keep piling ...