Endpoint Hardening: Closing Windows Before Somebody Climbs In

Did you know your receptionist's computer is running a web server?

And an Xbox game bar?

Neither one of those helps them answer the phone, but both are doors that

a bad guy can walk right through.

Uh, today, Prasanna and Mike and I, uh, talk about hardening your endpoints.

In other words, we're talking about closing the windows, locking the doors,

before somebody else comes along and, you know, starts trying to jiggle the handle.

We talk about secure builds and golden images, as well as which services

to completely uninstall so the bad guys can't just switch them back on.

We talk about doing things like locking down USB ports, and why

full-disk encryption does nothing if you don't actually log off.

Mike also talks about malware that lives in UEFI and survives a complete re-image.

If this is your first time watching or listening to me, I'm

W. Curtis Preston, AKA Mr. Backup.

I've been obsessing over backup recovery and now cyber recovery for over 30 years.

If that's your bag, I'm your guy.

You're not gonna find anyone that cares about it more than me.

Ever since 1993 when I had to tell my boss that there were no backups

of the database that we just lost.

Now I've written five O'Reilly books, a blog, and a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up.

Welcome to the Backup Wrap Up.

I'm your host, W. Curtis Preston, AKA Mr. Backup, and I have with me my

anchor and my rock, Prasanna Malaiyandi.

How's it going, Prasanna?

I'm, flattered I guess you could say.

Your anchor and your rock

what else do I refer to you as?

What do I else do refer…

As long as you don't call me, your ball and chain or

something, I think we're good.

you're my work husband.

except we don't work at the same place anymore.

Isn't that kinda weird?

Although you and I do a lot of work with the same company, but

just in a very different way.

Yes, that is true

and, and once again, I have my, my book co-author and friend, Dr. Mike Saylor.

How's it going, Mike?

Hello everybody.

Doing good.

Doing good

we're of course talking about the book Learning Ransomware Response Recovery,

which you, if you are watching us on the YouTube, the Backup Wrap-Up channel,

you can see over my, left shoulder, it looks like the right shoulder in

the picture, but oh, and there he is.

He's

And Mike's holding the book.

So then you could see, the ginormous poster behind Curtis, and for everyone

else who wants to read the book, Mike's holding up a picture of the book

So Curtis, e-enhanced for detail, and then this is the actual size.

It's a good, it's a good, it's got a good weight to it

Yeah, and it's, yeah, and for those that, if you haven't heard me talk about this

before, that poster, in order to look okay on the camera, that thing is ginormous.

That's It's literally

sent

Hang on.

I'm j-

publisher sent us one, but

Yeah, send us a small one.

I'm gonna go back here.

than, it's not much bigger than

You see what I'm saying?

yeah.

Anyway,

Yeah, it's two shelves on your book tall.

Yeah, exactly.

All right.

So today, friends, we're gonna be talking about, hardening, endpoints, which, you

know, just basically that, that thing that people, that, bad guys like to attack.

And Mike, I thought you'd start, you would start us off with this idea that

used, that you used in the book about, comparing, cybersecurity to, to houses

Yeah, I do that a lot and it helps, I think, people, relate cyber to the

real world, things you see every day.

You don't see cyber, you just, you get hit over the head with it every now and then.

But, when you think about your house, and we've talked about this analogy in

a lot of different ways but, backing up just a little bit, bad guys, when they

do a, when they look for weaknesses in your home, they're gonna look at all of

the potential entry points or weaknesses.

is that a, is the door unlocked?

is it a, a lock I can pick easy?

Is it a double pane tempered glass, or is it, some, some

older different type of glass?

and so when we're doing a vulnerability assessment, we're looking for weaknesses,

when we find an endpoint where the window's already broken, we know it, it's

got a vulnerability that's widely known.

it calls out to the internet, "Please, somebody me." those are the obvious things

that bad guys can pick up on very quickly.

as an example, we all miss Windows XP.

Do we?

you connect

That no one ever

if you con- if you connect a Windows XP computer to the internet, the

meantime to compromise is, minutes, that is a broken window that,

that's just asking for trouble.

But yeah, bad guys, when they look at an organization, broken windows are

those things that are just, they're already cataloged as known entry points.

Does it

what the, the bad guys think when they drive by my house and for some reason my

garage is just sitting there hope open.

Which is like every other day.

which is what's funny is, I have a Tesla, right?

And Tesla will automatically open the garage when I come up, and it's

100% successful when coming up to the house, opening up the garage

door, and it's roughly 90% successful shutting the garage door when I leave.

But it's so successful that I often forget to, double-check that

it's going down as I'm leaving.

And, and then I come back after having been gone all day, and

I go, "Huh, look at that. My

is, open." And the… And I even have all these fail-safes where I have,

I actually have a if this then that thing that kicks off, and it basically

runs every half hour and cl- tries to close my garage door every half hour.

And that fixes that about 50% of the time.

But the other 50% of the time, the reason why it isn't closing

is because something's in the way.

And, software's not gonna fix that 'cause that's a hardware problem, yeah.

Anyway, Prasanna

no, I, Mike, I like your analogy.

Is there something similar to be said?

you know how they say, to avoid getting eaten by a bear, you don't need to be

the fastest person, you just need to be faster than the person next to you?

Does that also apply for your broken window analogy too?

That

It does.

to, to some degree.

a lot of times, in that analogy, and there's others similar, like

I don't have to have the best security on my house, I just needs

to be more secure than my neighbor.

Or if you're gonna buy new

Yeah.

and something, expensive and you've gotta throw the trash away, throw

it away in your neighbor's trash.

so it's all about obfuscation and perspective, but a lot of bad

guys don't target Prasanna, right?

They're- I'm not- they're not just waking up tomorrow and go, "I'm gonna attack

Prasanna. And then while I'm attacking Prasanna, I notice that Curtis has more

broken windows, and so I'm gonna go attack Curtis." it doesn't happen that way.

W- the way it works is usually if they're truly targeting and th- then

they're hands on the keyboard doing this type of or reconnaissance, sure,

they're gonna look at one thing, and if it's too much trouble, they're gonna

move on to the next one, for sure.

but a lot of times today especially, there, a lot of the reconnaissance

is done through automation, whether that's AI or scripts.

And the bad guy doesn't even know, in a lot of cases, when

something's been compromised.

they've gotta go check their log or look at a dashboard or wait

till someone calls them and asks how much ransomware they owe.

but yeah, more secure than the next guy is, it's one of

those, zombie apocalypse rules

Yeah, a- again, going back to the house analogy, they're basically, they've got

a small army of, people that are just running up and checking every door,

every window at every house, right?

And if you happen to be the one with the back door open, your garage

door open, and your window open, you'll find yourself at my house.

Trunk open

the way, they're…

Go ahead

world, I use, I refer to as the kinetic world, they're hiring or

they're paying kids to do that.

They will pay a kid $5, $10, candy, whatever, "Hey, go see if that door is

unlocked." Because when you open the door and there's a kid there, it's a kid.

You're like, "What are you doing?

Get out of

What are you doing?

Yeah

stop being a nuisance," versus an adult who may have a different reaction

Interesting.

Yeah.

a good, that's a good way to get shot in some parts of the world.

maybe

What are we to-

Go ahead

So Curtis, so great analogy, Mike, but Curtis, what are we really

going to talk about on this episode?

the

how does it lead into what we wanted?

Yeah

Yeah, so the point of this is that the idea is that you do need to harden the,

the, the touchpoints, the endpoints where the cyber attacker, where the,

bad actor is going to try to attack you.

And, just to go back to the analogy, need to make sure that all the

windows are closed, that the doors are locked, that, all of these things,

and that we don't do anything stupid.

When we talk about it in the book, Mike, I remember, not… The book is not,

like, not to get ransomware, right?

We, we took an assume breach position, but that doesn't

mean that you can't try, right?

You can do the stupid stuff.

Make sure your windows are closed.

Make sure your doors are locked.

the stuff that you can do relatively easily, make sure you do those things, and

that's what we're gonna talk about today, is basically hardening, the endpoint.

And the first thing that we wanna talk about, and Prasanna, I know you've

talked about this with me before, so maybe you're gonna jump right on

in here, and that is this idea of a secure build and a golden image.

What are we talking about there?

Oh, yeah.

So you could do the sort of not necessarily a simple thing, but

take a pre-installed version, like a new laptop ships, from a vendor.

And you take it and you're like, "Okay, I'm just gonna install some software on it

and just hand it off to my users." There's probably a whole bunch of things running

on there that you don't necessarily need.

It's not something that makes it easy to repeat and have a consistent

view across your entire environment.

And so what you really want is a golden image that you can quickly install.

It isn't painful, but is consistent, and it only has what you need in

your environment and nothing more.

So if you don't need…

And Curtis, I know we will talk at some point about your favorite topic, but if

there are certain services you don't need to be running, then don't have them run.

Don't install it.

If there are certain programs you don't need, get rid of all the

bloatware, everything else as part of this golden image that you can

then replicate and install and reuse consistently throughout your environment

Yeah, and the whole point here is that you're essentially

restoring the laptop, right?

You're taking this image that you have backed up, and you're wiping the laptop.

and you're not just… you could do it in a different way.

You could say, "I'm buying a, this will work, but it- it's limit- limited

functionality, where you get a brand-new laptop, and then you have, like a scripted

installation of various pieces of software and the deactivation of certain features.

But, what we're really talking about here is the idea that you would have

this image that you're going to restore a complete drive, to that laptop

or to any other endpoints, right?

Servers and things like that, so that you're basically, in one

step, you get the baseline of everything you need to be functional.

And we normally think about this in the case of like virtualization, right?

Where you have a golden image that you spin up new VMs for, from.

But the same thing also applies, like you said, Curtis, for endpoints,

where you're just spinning up this golden image across your devices

Yeah.

Any thoughts on that, Mike?

so one of the things to think about too, and you need a strategy for that.

so you can't just… A- I did this a long time ago where I just went into

all my services and started turning things off, and yeah, maybe it worked

at the time, but then, tomorrow I need to something and it's not working

'cause I turned some services off that I needed for whatever that was.

so there, there needs to be a strategy for how you build your image.

and I think we're gonna touch on that a little bit more here in a second, but,

that, that approach, that image needs to be specific to the different hardware

that you deploy out into your environment.

So one of those strategies would be minimize the dif- the variety of

technology, 'cause that's just gonna help you as a, an IT department to…

you're maintaining less, variety, so the problem with this is the, the solution to

that problem's gonna be the same across And so now that golden image applies to,

the, the one, maybe two different types of, device models that you've got out.

one thing, real quick, one thing I will always hammer on is document that thing.

don't just build it.

Write down why you built it that way and how it was built, because

it's gonna take time to, to d- to troubleshoot why that image didn't

work or why that image isn't working with certain applications or whatever.

Now you've got a document, and we can refer to that, and then

you just, you update that, that image as, exceptions come in or

that build, is modified over time

Mike, I'm glad you touched on the point about sort of you might need a different

golden image per hardware, and so consolidate down hardware such that it

makes it easier and more streamlined.

What about in terms of, different roles within an organization?

So as an example, do you see typically, or like an engineer might need a different

golden image than, say, someone in finance or in HR, or do you also recommend trying

to consolidate down as much as possible to a single golden image that can be used

across many people in the organization or as many people as possible, and

then for things that an engineer might need, then there's additional scripts

you run on top of that golden image?

I'm gonna answer for Mike.

You ready?

wait, Mike, I know what your answer is.

it

It depends.

It depends.

Absolutely depends.

It depends on the environment because, for example, maybe your engineer needs

a different computer all together.

"I need better hardware.

I need more

RAM.

I need a different processor." that's a different image for

that different piece of hardware.

All right, but that's one approach.

But really, the, the approach you should take understanding the

different levels of hardening.

So level one hardening is just basic works- workspace type hardening.

do I need, Microsoft?

They, One of the services is a web server.

Why is a web server running on my receptionist's computer?

what a RDP, one of Curtis's favorite, or even remote procedure calls.

If, it depends on how your environment's built.

how do you support these devices?

If you're doing it remotely, you need some of that stuff.

If you're not, turn it off.

PowerShell.

Bluetooth.

Why is Bluetooth running on a server?

It depends.

Because I s- because… Yeah.

Oh, yeah.

maybe not.

Maybe you shouldn't.

'Cause I saw "Mr. Robot," and you can hack an entire, system via

Bluetooth from the police car.

Outside, yeah

but, w- I, also th- a s- a related idea would be a sort of a base image

everyone, and then scripted addition, yeah, yeah, the lowest common

denominator, and then scripted addition of certain software on top of that.

The exceptions, right?

we turn off, go back to RDP.

We turn off RDP for everybody.

No one needs RDP, right?

And then we go, we turn it on for the two people that need it.

And you

Coffee maker

can automate that, right?

What'd you say?

The coffee maker needs RDP

Yeah, the coffee maker needs RDP.

and we- and we touched on this a- a few times here, but one of the

other things is the whole idea behind hardening this, so is, w- or thing

that we're doing here is turning off things that don't need to be on, right?

Can you think of other things, you've mentioned Bluetooth on servers.

the… So I, I see on our list here Xbox services on workstations.

Is that actually a thing?

It is.

It is.

What?

especially Dell computers come with Xbox, the, the game bar and

other stuff, running by default.

only do you need to turn stuff off, you need to uninstall

the stuff that you turned off.

Because at some point, if that endpoint is compromised, bad

guy living off the land, right?

So bad guy finds out what's on this machine, it's turned off.

"Oh, I just need to turn it back on and I can use it." not

just turn it off, uninstall it

I remember when I was at a very large company, which everyone listening to

this podcast has done business with, they had… And these were Unix servers.

So there was this, there's this file, inetd.conf that would

define all of the ports that were on or off in a Unix system.

And their way of doing this was they had an inetd.conf that they pushed out every

day, to all the servers so that, What made me think about it, Mike, was, you're

talking about you wanna turn it off, so you'd wanna uninstall it so that if they

turn it on, it's not gonna work, right?

Their way of doing that was to push out this, this inetd.conf, every day.

And the way I found this out was I was installing backup software, enabling

backup ports, then my backups would stop working the next day, and I would go to

the inetd.conf and my ports would be gone.

And I would… It drove me batty for a couple of days until we found out that

they were actually pushing that out.

But that's the kind of thing of, having a standard, defining all of these, ports.

Can we think of any other types of services?

we talked about print services, SMB, NFS, any, anything else?

Anyone?

Anyone?

Bueller?

services that are often, turned on by default are workstation

and server, on a nor- on just any computer, laptop, workstation.

but those are… and so is, drive indexing.

all of those are resource hogs, m- but before you turn them off, you've

gotta understand what they do and how they are used in your environment.

but if you can, you'll free up, 5 to 8% of your resources.

anything web related by default could be turned off.

there's probably out of probably 60 or 70 services that are running by default,

probably 50 of those could be assessed to determine if they can be turned

off, at least not automatically started

Yeah, I know when you're putting together like a Linux image, with a lot of, with a

lot of the, packages that are available, they will say, "Do you want this hardened

or not?" And they do the opposite, where they by default turn off everything

except for the bare minimum that you need.

talk about USB locking down.

Prasanna, you've done a lot of work

I've…

some big companies

Yes, where they have disabled USB, and my gosh, is it a pain.

It, here, and here's why, right?

Here is my reasoning.

So I totally understand why, right?

You don't wanna just have a random person plug in a USB.

We see a whole bunch of cases.

I think there's a couple Apple cases going on right now where

people downloaded schematics onto a USB drive and then walked out to a

competitor, and there's a whole bunch of lawsuits pending around that, right?

As an end user, I have a very practical situation.

I might have, my W-2 or my other tax documents that are available

internally on the company website that I need to be able to transfer out.

I don't wanna send it over email, right?

Very rarely can you file share outside of a company to your own personal account.

And so you're only left with, USB.

And there are some companies I've worked in where they're like, "Yeah, you can't

plug in a USB drive because we do not allow that." Yeah, you can plug it in.

USB keyboards work great.

USB mice, totally fine.

USB drive, eh, sorry.

Oh,

And it was painful

they don't pour like, epoxy in the USB port

This co- this company did not.

school.

Yeah.

JB Weld

Yeah.

super glue

Yeah.

what, Mike, do you have any thoughts on the USB?

I,

I

is,

still, Prasanna,

this is gonna go back to the it depends thing, right?

I've been in companies where this is an absolute necessity because, we're,

because we're dealing with super secret stuff, and your W-2 problem

is the last I care about, right?

an analog solution for that, Prasanna.

Just it up on the screen and take a picture of it with your phone.

Yeah,

Not the same though, Mike

Yeah, I understand.

But-- and I've seen the USB lockdown policies, but every time

I see that, there's exceptions.

we only do that to the general population.

The executive team still needs to use their devices or somebody, definitely IT

in the build room, those types of things.

But with everything that you implement as a control, you've

also got to be able to monitor it.

is-- did somebody bypass our USB blocking?

And you're telling me that the USB port still allows me to u-use a USB

keyboard and a mouse, so now I just need to go buy a rubber ducky, which

is a USB that when you plug it in, it shows up as a USB or a mouse.

So there's way to circumvent controls.

how are you monitoring that?

and I can definitely see the value.

I've seen a lot of, environments where incidents could have been prevented

on the, the incoming, like someone brought something in that had a virus

on it, and it infected the endpoint.

so that… that's probably one of the key, reasons.

then on the intellectual property or data leakage side, you

don't want your data leaving.

And there's alternatives.

So you can block the USB, and that's just, that's the easy thing.

We're just gonna shut it off.

and there's, especially in today's Office 365 environment with Microsoft

Purview, you can implement data leakage that will tell you when someone copies

stuff to a, an external drive and how much and what was the file name and

when did it happen then who do I tell.

so there's alternatives to making it painful people,

for people to get their W-2s

The, and then the final thing that we talk about in terms of locking it

down is the BIOS or the UEFI layer.

We'll let Mike talk about that

Sure, I'll start.

and we've, we briefly mentioned lowest common denominator, and that, that is

a lot of ways how bad guys see targets.

they're gonna start at the simplest layer.

for example, whenever we red team an, a company, they attack us every

way you can or you can think of in order to achieve these objectives.

the first thing that we try to do is steal a computer that's got

all of the password hashes on it.

and if we can get into that computer, then does it… Does, is there some

kind of network trust with that?

and of the time that's been effective.

piggyback in a door, take the first laptop dump the passwords, and we've

got a local admin account in 30 minutes.

and then the rest of the project goes fairly quickly.

when you think of hardening your computer, your idea is not just to reduce the f-

the, the footprint of all the thing, not just from a security sh- perspective,

but also from a maintenance perspective.

If you're taking all this stuff off that you're not using and you're

turning off stuff you don't need, maintaining that machine is a lot easier.

creating less overhead across the network, so now the behavioral analysis

of your network and your trending and all that stuff is a lot simpler.

but all that's great, but if I can just walk up and touch this computer,

even if it's turned off, maybe I can get into the BIOS, I can reset

things, turn off passwords, what have you, accessing the computer that way.

So maybe the, the USB drives are turned off by policy in Windows, but I can boot

from a USB out of the BIOS, and now I can take advantage of this computer that way.

And then you have the UF, UEFI, or we also call that the baseboard controller.

so that's all the stuff that is hard-coded that tells c- the hardware how to

work together before the operating system, even before, back in the

day, DOS would run and then Windows.

the baseboard controller is firmware that and runs before all of that.

And so if I can compromise that, there, there's, there are ways of embedding

malware at that layer so that you come and y- log into your computer

like you usually do, not knowing that a lot of that fundamental hardware

layer, is compromised, and I'm… I've

and wasn't there a compromise recently, Mike, where people installed malware at

the UEFI layer such that it was persistent no matter what you did from trying to wipe

the drives and everything else like that?

Yeah, that was a nightmare because, you think you've, you understand the

compromise and you try to clean it.

In this case, they tried to clean it, and then they realized that it persisted.

They… And it was the, the persistent communication out of this device.

They weren't noticing anything on the device.

it was at the network layer they, that they determined that

the threat was still there.

So then they completely rebuilt the computer, and rebuilt meaning re-imaged

the drive, completely overwrote all the software, and it was still there.

And that's when they realized that it's not the, it's not on the drive,

it's in the, it's in the hardware

Just a final thing on the, the hardening of an endpoint.

Mike, you t- you talked about a, a really good, or made a really good point with

the stealing of the laptops, right?

Which are super easy to steal.

And I actually once… I don't know if I told you, Mike, but

I was in Houston once, right?

and on a seminar trip, and there were three of us, and we went inside to have

dinner, and just weren't thinking and left our laptop bags sitting in the car,

and then they did a smash and grab, and we lost all three laptops just like that.

thing with… And the real issue is if you have physical access to laptop, and

then again, the USB port, and, you can pretty easily boot into that, and then,

get access to the hard drive or the SSD, there's… What do we do to defeat that?

Anyone?

Anyone?

Encrypt, encrypt

Yeah.

Full disk encryption.

Yeah.

so you know, when you've got a laptop and it's closed in a bag in your car,

hopefully it is, it's not in standby mode or suspend, it's actually logged off.

Why do you always come up with these things, Mike?

You always come up with these things where it's of course you turn off

your laptop, you don't suspend it.

No one does that, Mike.

You do it, though.

So if you're already doing this hardening, your go- your golden image

setting for closing your laptop lid

Okay.

All right

you off and putting it in suspend.

Okay

if I took a laptop that was in that state and I'm able to boot and, there's

any number of tools out there that allow me to boot into a Linux environment

off of a USB through the BIOS.

And so now I'm an admin on this machine, and it, so it created

this little for me to run Linux.

If your drive is not encrypted, I can see everything.

can see all your Windows containers and objects and all of that stuff.

I can even reset your Windows password.

But if you're encrypted, if you're using BitLocker or something else,

then like Prasanna mentioned, I just see gobbledygook.

yeah,

encryption's key, but encryption only works when you're logged off

And this is where even for phones, right?

They talk about boot first use, where things are still encrypted versus

if you just have a lock screen where it's easy to, for law enforcement

to access your device as an example.

So Mike, let's continue to depress me.

so red team me a little bit, okay?

So I've left my laptop, suspended, not logged off.

So you open up my laptop and you see the login screen.

You're not me.

You don't have my password or my fingerprint.

What, how do you then… 'Cause I know how to get into a laptop regardless, right?

Booting it, and booting it off an alternate device, but how are you

gonna get into the laptop like that?

we're not gonna turn this into a how to hack 101, but

Okay.

are tools.

Okay

and at that point it just becomes a, a problem-solving, puzzle.

solve this puzzle.

it's suspended, it's not logged off.

Do the USB ports work?

Yes or no?

Is there Bluetooth enabled?

Yes or no?

Is wireless enabled?

Yes or no?

Does it have an ethernet jack?

Yes or no?

USB-C,

case, the answer is yes to all those things.

I'm gonna go down the list starting with the simplest thing first and working

Gotcha.

up to the most complex and

Okay

somewhere along the way I've got a, I'm a- I'm able to break a window or open a door

Yeah.

and one of the things that, that you should always understand, and hopefully

you hear this, you've heard this multiple times in other places, I know

we talk about that book, and that is physical access trumps everything, if

you've got physical access to a laptop or a phone or a server or whatever,

it, that just trumps everything.

At a minimum, I can wipe everything.

Even, even though we talk about the encryption, right?

At minimum, I can still wipe your hard drive, right?

but, anyway.

All right.

So let's ta- let's t- talk about a quick, We've been talking, once again,

we figured out how to talk about this way longer than I thought we were going to.

talk about running a port scan.

You wanna, Prasanna, you wanna talk about what Nmap is?

Yeah.

So it basically is a tool that you can run against a device, and it will scan and

try to look for whatever ports are open.

And this is important because, well-known services run on specific ports.

I think RDP is like 3359, I wanna say, and like SSH is 22, and so it's a list

of well-known ports for these services.

And so if something comes back and is like, "Hey, port 22 is open," or 3359,

then the attacker knows, "Oh, by the way, that means that RDP is running on that

machine or SSH is running on that machine.

Is there a way I can compromise that or connect to that to exploit it?"

Be even more worried if port 23 was open

Anyone?

Anyone?

too, so even if…

That's Telnet.

Yeah

Anyway

those, and FTP, Telnet, right?

and so those are services that shouldn't be running on a

desktop inside your environment.

But in the event that you do need those, making sure that when the bad

guy pings that and says, "Oh, that port's open. I wonder if it's RDP.

I wonder if it's Telnet." The next command he's gonna run is to try and

grab the banner of that service to see what version and type is running.

And so you can modify… So if you absolutely need these things running,

you can also absolutely change the information that's available.

w- and we call that en- the enumeration part of reconnaissance.

So I know that there's a port open, the next enumeration phase

is, what's running on that port?

And you can change what, what's provided to, to respond, that response

I actually didn't know that.

let's talk about, we talked about creating a, golden image.

The first thing, if we're going to create a golden image, we

have to first decide what's gonna be on that golden image, right?

So we're gonna have to get a

checklist,

RDP

yeah.

Get a checklist of the things that need to be on, the things that, you know…

And just as importantly, if not more importantly, the things

that need to be off, right?

and then that's how we work our way towards the, the golden image, right?

and I would say that a good starting point is to, we've mentioned it already,

but I'm just gonna reiterate it, is a good starting point is that if you can

come up with one image that's the least common denominator for everybody, right?

That's a good first step, right?

don't, don't let, the whole, don't let, perfect be the enemy of the good, right?

So start somewhere.

Do a single golden image.

Everybody's gonna run Windows XP with patch ABC, right?

and, Office… Wait, WordPerfect version 14, and Lotus 1-2-3.

that's what we're gonna run on there.

I'm just trying to just sound really old.

Anyway, yeah.

And so you do that, and then you can move forward from there.

and then finally, Mike, w- I wanna talk about just, again, the ultimate

endpoint is what's the endpoint that we always have with us?

What?

Your phone

Yeah.

So let's talk about, just talk about that a little bit, the, because that's

very, that's a very specific endpoint.

And for most companies, for most employees, that is a personal

device, but it's a personal device that is allowed, in most cases,

to log onto the corporate, Wi-Fi.

so what can we do to help secure this very not secure device that is,

logging into our corporate network?

So there's a couple things.

One, i-if you're not blocking USB ports, you can write a policy that says USB

ports work except for data transfer.

We won't-- We, we'll block data transfer.

So now we can at least charge our phone on a USB port, you're not able to transfer

data, which is important because bad guys are putting malware on people's

phones knowing that they're gonna go to work, plug it in to charge, and now

the mal-- That could be an entry point.

then most of the world is using Microsoft products, there are Microsoft products,

whether you're, you've got a, an on-premise domain or you're using Office

three sixty-five, on your licensing.

But, I think everything except the basic license for Microsoft

three sixty-five comes with Intune.

I it's called something else now.

But Intune is, has a mobile device management component that says, "All

right, Curtis, you can use your phone, but the moment you log in, the, the

day that you set up our email on your phone, you've got to agree the

company is gonna manage this data, this company data on your phone.

So when you leave, and we delete your account, it's also gonna reach into

your phone and delete our company data." and then there's ways of managing that

through Intune. So as an admin, I can go in, and I can see all the mobile

devices. I can also develop policy that says, "You've gotta have antivirus.

You've gotta have a pin code.

You've gotta have these things." And it'll tell me whether or not these devices are

compliant that list of, requirements.

Yeah.

At a minimum, make sure you're updating your device whenever patches come out

because the Apple, Android update process is a lot, a lot more strict than Windows.

Windows is gonna push out an update just because said the color scheme is off.

But Android and Apple are only gonna push updates out when there's critical

things to fix or a new feature.

but know too that whenever you apply one of those patches, it overwrites a

lot of the core firmware, the kernel.

And if you have malware on your phone that maybe rooted it or spyware,

a lot of times applying those patches will overwrite that malware

So it's a good thing to do is apply the patches.

thing to do.

do

All right, and with that, I wanna thank Prasanna once again

Thank you, Curtis.

I am your rock and your anchor.

it's funny, when I heard rock and anchor, I'm like, "Those are two

things that can really weigh you down."

and I am your paper.

I

and thanks again.

then

Thanks again, Mike.

Yeah, the scissors of this podcast.

And thanks again to our listeners.

you are why we do this.

That is a wrap.

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening