Week 15: Series overview and final thoughts

This week’s session was packed with even more actionable strategies to help harden your environment.

What we covered in week 15:

• Deploy agent and configure test groups
• Audit and restrict USB usage
• Disable Office macros
• Review and block or contain high-risk applications
• Review network traffic, with focus on high-risk ports
• Deny most inbound traffic on workstations
• Audit local administrators and when they last logged in
• Remove unused administrators
• Windows 10/11 audit then disable SMBv1
• Set password-protected screen saver
• Turn off Windows keylogger
• Turn on BitLocker
• Disable mDNS
• Block Telnet
• Disable AutoRun
• Block Windows Recall
• Restrict most outbound traffic allow inbound as necessary
• Set up an alert if an application is denied
• Enforce MFA for login
• Follow the principle of least privilege
• Audit domain accounts
• Audit and set fine-grained password policies
• Enable Group Policy auditing
• Enable LDAP signing requirements
• Keep built-in macOS protections enabled
• Enable disk encryption with FileVault
• Disable macOS sharing services or allow only on request
• Register domain names with look-alike or similar characters
• Inventory online accounts and enable MFA where possible
• Avoid SMS-based MFA where possible
• Use Conditional Access for Microsoft 365
• Use audit mode or the what-if simulator to avoid lockout
• Replicate security defaults
• Use company branding in Microsoft 365 and ThreatLocker
• Filter malicious web content
• Use Cloud Control to update named locations dynamically
• Set up MDR for Cloud Detect
• Run internal and external port scans
• Turn off VPN if not required use dynamic ACLs instead
• Patch all devices including routers
• Conduct regular backups and test them
• Review ThreatLocker DAC and Syslog ingestor

This series has been all about building your cybersecurity maturity, one week at a time. The series has now concluded, but you can still watch all 15 episodes here.

‍A quick note

This webinar series is designed to be as technology-agnostic as possible. You don’t need ThreatLocker to participate, but it certainly helps.

If you want to follow along more easily, we’d be happy to help you get started with a ThreatLocker agent. Just book a demo to chat with a ThreatLocker Solutions Engineer and get a 30-day free trial to the entire ThreatLocker platform.

Thank you for joining us on this journey!

‍