4.5 Common OS Mistakes and Safe Configuration
Defaults That Bite
Most breached hosts were not defeated by exotic exploits; they were configured into weakness. The top repeat offenders: using one global administrator account for daily email and browsing, so any phishing drive-by inherits admin rights; leaving dead legacy protocols enabled -- SMBv1 in particular, removed from Windows since 1803 but still present on un-upgraded boxes, disable it with dism /online /disable-feature /featurename:SMB1Protocol; and skipping disk encryption, so a laptop left in a taxi is a full disk image handed to an attacker. Unpatched legacy libraries and abandoned "temporarily" open RDP or SSH exposure round out the list.
Why These Defaults Fail
Each mistake widens the blast radius in a specific mechanism. Daily admin use means UAC or sudo is clicked yes all day, so malware no longer needs its own privilege escalation -- it inherits yours. SMBv1 negotiates without mandatory signing and hosts the attack surface behind relay exploits, so one listener on an untrusted network can turn into domain compromise. Without BitLocker or LUKS, offline attacks are trivial: boot from USB, mount the volume, and read SAM hives or crack password hashes at leisure. And every unpatched library is a public exploit with a published CVE -- attackers do not break in, they log in through last month's fix you deferred.
Hardened Baseline
A baseline is a short list of enforced settings, not a wish list. Split accounts: standard user for daily work, a separate admin account used only for elevation. Enforce UAC at "Always notify", and on enterprise Windows deploy LAPS so local admin passwords are unique, randomized, and escrowed. Require SMB signing, disable v1 outright, and keep only the profiles' firewalls on. Enforce disk encryption with recovery keys escrowed to your directory or key management, and pin security-relevant policy with secedit /export /cfg c:\secpol.cfg exports reviewed against your standard. On Linux, the equivalents are lockdown on sshd_config (key-only auth, no root login), nologin service accounts, and automatic security updates from 4.4.
Change Safely
Hardening breaks things, so apply it like any change. Stage settings through the same rings as patches, keep one known-good admin account that the baseline cannot lock out, and snapshot or checkpoint before registry or policy edits. Document every deviation ("RDP stays open on this host until Friday") with an owner and an expiry date -- undocumented exceptions are how temporary holes become permanent. Re-audit quarterly: enumerate local admins, protocol versions, and encryption status again, and compare against the documented baseline, because configuration drift is the default and enforcement is the exception you have to maintain.
Architecture Diagram
Key Takeaways
- Daily admin accounts are the single most common OS mistake: split standard and admin identities.
- Remove SMBv1 and enforce SMB signing; dead legacy protocols are pure attack surface.
- Enforce disk encryption (BitLocker/LUKS) with escrowed recovery keys or the data is not protected.
- Undocumented exceptions become permanent -- log every deviation with an owner and expiry.
- Configuration drifts by default: re-audit admins, protocols, and encryption against the baseline on a schedule.