Corporate Endpoint Management and Hardening
Reducing unnecessary services and permissions
Hardening corporate endpoints consists of configuring each work device with the fewest possible active services, ports and permissions, disabling unused features and applying stricter security settings than an operating system comes with by default. In practice this matters because every unnecessary enabled service, such as unrestricted remote desktop or Office macros enabled by default, represents additional attack surface an attacker can exploit with no business reason justifying that risk. A concrete example is disabling the automatic execution of macros in Office documents downloaded from the internet, a simple setting that blocks one of the malware infection vectors most used in phishing campaigns targeting corporate employees.