-: Group Policies.
A Group Policy is a set of rules or policies
that can be applied to a set of users
or computer accounts within an operating system.
Now, to Access the Group Policy Editor,
simply go to the run prompt and enter gpedit.
The Local Group Policy editor will then launch and
this is used to create and manage policies
within a Windows environment.
Each policy acts as a security template
that can apply a set of rules to different users.
These rules can contain things like
Password complexity requirements, Account lockout policies,
Software restrictions, and Application restrictions.
If you're using an Active Directory domain controller
in a Windows environment, you actually have access to a more
advanced version of the Group Policy Editor as well.
In corporate environments,
it's common to create a Security Template with
predefined rules based upon your Organization's
Administrative Policies.
This Security Template is a group of policies that can be
loaded through a single procedure
within the group policy editor.
A large part of hardening the operating system occurs
through loading different Group Policy objectives or GPOs
against the workstation or against the server.
These Group Policies are also used to create a secure
baseline as part of your larger
Configuration Management Program.
Using them, new accounts and computers can quickly be
configured with all of your organizational requirements.
After creating your secure baseline,
it's important to conduct Baselining.
Baselining is a process of measuring changes in the network,
hardware, or software environment.
Effectively, baseline helps establish
what normal is for your organization.
By knowing what normal is, you can then identify what
abnormal or a deviation looks like.
For example, if you're looking at your network utilization
over a period of time,
you can identify high periods and low periods.
If you normally have low periods of activity during a
Saturday afternoon, for example, but this Saturday
afternoon, you saw an excessively high amount of activity.
You should look into that and investigate it.
For example, in this image, we can see one very
high spike of activity.
We would compare this to a known baseline
and then determine this spike is expected or
if it should be investigated further.
Every deviation should be looked at and categorized as
either acceptable and expected or
an issue to investigate further.
Many data breaches have been discovered by investigating
higher than expected network utilization
during periods of time that should have been relatively low.
By looking at this, they have found things like
data exfiltration and other problems that
have happened through the network.