If you want to stop any Virus getting to your computer, take out the USB controller, take away the NICs and lock it in the closet, it's the closest you're going to get. There are countless things you can do to make the security of your network better, I've probably gone a long way out of scope of what you wanted, I just thought a wider view might help you make informed decisions about what goes on when thinking about security for your network. Make sure Windows Defender or better is installed and always set to do regular scans and updating. Make sure SmartScreen and UAC are both on, they're not to STOP Viruses from happening more a barrier to let people know what they're doing. If you're worried about this upsetting people if you're on a domain make a temp.admin account that has a rotating password that changes every hour that will be displayed on a website they have to enter their domain password to get into, this can limit people just randomly installing things by accident this they're not administrators. This an help stop a fair amount of social engineering tactics ads might be using to get people to download programs.Īgain to bring back up PoLP you could make sure your users are not local administrators on their machines, this can limit what they can break on their computer, although it would just limit to their files not Jan's from accounting if they share a computer. You could put better protections in place and setup something like Quad 9 (DNS) to help block malicious domains if that is out of scope or not feasible setup a local pi-hole or enforce end users to have an ad-block. These folders in my workplace would be considered the most essential for day to day use, anything else like "Downloads" might be overkill, although it never hurts to be safe.įor the AppData limiting, that is an interesting one as a lot of programs do like to install themselves there, however do you stop your users installing stuff like Spotify, Chrome (Will install to Roaming AppData if the user doesn't have Admin perms to write to C:), Minecraft.
Note: Most cloud providers have inbuilt ransomware protection on the cloud side of things so this might not be needed.
0 kommentar(er)
