It’s good to have a baseball bat...

With this in mind:

• Patching – are you really patching EVERYTHING and how are you doing it? Are you patching operating systems AND third party applications? Are you getting urgent patches on quickly, are you rebooting endpoints to ensure patches are applied? What about network devices, switches, printers and IoT devices?
• Identities – do you have a strict password policy that’s applied to all users? Do you have account lock-outs configured? Do you have conditional access policies including geofencing for known safe locations? Do you limit privilege accounts and separate them from normal accounts?
• Multi-factor authentication – do you have this turned on for ALL users, without exception, including shared accounts (if you have to have them).
• Firewalls – endpoints are no longer behind the corporate firewall all the time, do you have firewalls turned on for endpoints and are you restricting inbound and outbound traffic?.
• Applications – do you restrict what can be installed and have you removed local administrative access?
• Removable Media – do you restrict access to removable media, including USB sticks.
• Connectivity – do you restrict web activity of known malicious sites? Do you remove internet access from privilege accounts and high-risk servers?
• Hardening – have you completed Active Directory hardening? Have you plugged the known issues that protect your key authentication database from being compromised? Have you hardened your servers?