-: Let me ask you a question.
How many applications do you have installed
on your computer right now?
Now, I don't mean how many are currently running.
But how many exist on your computer in total?
Do you have five? 50? 500? Or maybe more?
Each application that's installed on your device
takes up valuable disk space,
but more importantly, it introduces additional code
and therefore, additional vulnerabilities.
To combat this, system administrators attempt
to practice a concept known as least functionality.
Least functionality is the process
of configuring a work station or a server
to only provide essential applications and services
that are required by the user.
To create an environment of least functionality,
administrators should restrict unneeded
applications, services, ports, and protocols.
Another method of doing this is
to uninstall any unneeded applications.
After all, every application that's installed
on a computer must be managed, updated,
and it provides yet another chance
for a vulnerability to be introduced into our system.
Now, our computers at work are often under
a process known as configuration management.
Most of our personal computers, though,
have become a mess with unnecessary programs
being installed and accumulated over time.
For example, if you open up your programs
and features section of the control panel,
take a look at all of the various programs
you have installed.
You might be surprised at just how many
are on your computer.
For this example, this computer had 132
different programs installed that took
over 400 gigabytes of disk space.
Looking through that list, there is a lot
of unnecessary programs that that user could have uninstalled.
As we previously mentioned, it's important
to keep your programs and you software up-to-date.
Sometimes, though, new programs are installed
the old version is simply not removed.
Recently, we updated our video editing software
from Adobe Premiere 2018 to Adobe Premiere 2019.
After the installation was complete,
we saw that both versions remain
installed on the computer.
To eliminate the vulnerabilities from the 2018 version,
we had to go back and manually uninstall it from our systems.
Now, this may be easy to do when you
have a small network of just few machines.
But how do you do this when you're managing
a huge enterprise network?
For example, one network I used to manage
had over 10,000 computers spread across four countries.
It would have been impossible for me
to send a system administrator
to check the installed programs on each
and every computer throughout the network.
In large networks like this, preventing
excessive installations is the best solution.
In our corporate networks, it's common
for us to create a secure baseline image
that we use for all of the work stations across the company.
This image will have the operating system,
the minimum applications required,
and strict configuration policies
that are set up for all of those machines.
These polices, though, do have to be updated
and changed over time based on
changing business requirements.
We can use the Microsoft's system center
configuration management or the SCCM tool
that allows us as admins to manage
large amounts of software across the network,
as well as push out new configurations
and policy updates to all of our PCs.