Before we begin working with a security baseline,
let's spend a couple of minutes to establish why baselines are beneficial.
Now remember that Windows and Windows Server are
designed to be secure out of the box.
However, nothing is secure out of the box.
Many organizations will also want to have more granular
control over the security configurations,
and this is where baselines come into play.
A secure baseline is a baseline that has been tweaked by the
security vendor to enable secure settings.
In our case,
this is a baseline that's been tweaked by Microsoft that would enable
the server to make use of the most secure settings,
ultimately strengthening your security posture.
The aim of these baselines is to help mitigate a
threat without operational issues.
Now I've got an asterisk there because there will be some type of
operational issues depending on the configuration of the baseline.
So, for example,
you may have a setting that controls how many cached
logins are happening on your clients.
If that setting is set to 0, which is a secure setting,
it can cause operational issues because any computer that
cannot contact the domain will ultimately not be able to log
in with the cached logging account.
So this tells us that every single secure baseline and every
single setting within the baseline needs to be scoped and
tailored to the organization.
Now don't get me wrong,
security baselines are great because they help you identify the
different settings that need to be configured.
Think, for example, the group policy settings for Windows 10.
There are over 3,000 different group policy settings.
Can you imagine going through every single setting to
make sure that these are secure?
When you rely on a security baseline,
all the security settings for those group policy
settings would be enabled for you,
making your life a little bit easier because you just need
to go through the settings and tailor them based on what
you need in your organization.
Another benefit of secure baselines is that you can use these
baselines to enforce a secure default compliance state.
This means that as you go and you deploy more servers or clients,
if you've got a secure baseline that you have tailored to your organization,
you can link these to the different organizational units,
and as machines are added to those organizational units,
they will get those secure settings.
So these are just three points that explain why baselines are beneficial.
Now,
let's move onto the next video where we're going to actually work with a security baseline and apply this to our server environment.