Skip to main content

5.5 Workstations & Endpoints

5.5 Workstations & Endpoints

  • Configuration Standards:

    • a. Disable Windows Management Instrumentation (WMI), PowerShell, and Secure Shell (SSH) on workstations. SSH may be temporarily enabled by a DTC technician for troubleshooting and disabled upon task completion.​

    • b. Enable SSH on servers for secure remote management.​

SecurityIncident Agents:Response Integration:

  • c. Deploy Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) oragents Endpointacross Detectionall andcompute Response (EDR) agents.resources.​

  • d. InstallEnsure VPNcontinuous clientsmonitoring whereand applicable.analysis of endpoint activities to detect and respond to potential threats.​

  • e. Facilitate collaboration between EDR/MDR solutions and the Security Operations Center (SOC) to coordinate rapid incident response and remediation efforts.​

VPN Clients
    f. Deploy relevant VPN Clients for clients remote access. Roaming Content Filter
      g. Deploy relevant VPN Clients or DNS contentRoaming filtering agentsAgents on laptops.​laptops to filter content and protect the user from triggering malicious activity.

      User Lockout Policy:

      • f.h. Trigger a 5-minute lockout period after 10 failed login attempts.​

      Screen Lock Policy:

      • g.i. Activate screen lock after 12 hours of inactivity.​

      Software Maintenance:

      • h.j. Deploy operating system patches according to the schedule. See Technical Controls

      • I.k. Install drivers according to the schedule. See Technical Controls

      • j.l. Deploy essential third-party applications according to the schedule. See Technical Controls

      • k.m. Install Line of Business (LOB) applications according to the schedule. See Technical Controls.

      Application Allowlist Blocklist:
      • l.n. DTC does not enforce application allowlisting or blocklisting unless consulted with! Any applications deployed by the client is the responsibility of the client. We can work together though and take action to resolve these situations if the client has a documented allowlist and blocklist.

      Technical Controls:

      Control ID Description Tools/Methods
      a Disable WMI, PowerShell, and SSH on workstations; enable SSH temporarily for troubleshooting. NinjaOne RMM, Microsoft Windows PowerShell, SOP
      b Enable SSH on servers for secure remote management. NinjaOne RMM
      c

      Deploy MDR/EDREndpoint Detection and Response (EDR) and Managed Detection and Response (MDR) agents onacross endpoints.

      all compute resources.​       		NinjaOne RMM,NinjaRMM, Blackpoint SNAP Agent
      d InstallEnsure VPNcontinuous clientsmonitoring whereand applicable.analysis of endpoint activities to detect and respond to potential threats.​ NinjaOneBlackpoint RMM,SNAP Cloudflare WARP, ZeroTierAgent
      e DeployFacilitate DNScollaboration contentbetween filteringEDR/MDR agentssolutions onand laptops.the Security Operations Center (SOC) to coordinate rapid incident response and remediation efforts.​ NinjaOneBlackpiont RMM,SNAP Agent
      f Deploy relevant VPN Clients for clients remote access. ZeroTier, Cloudflare WARP g Deploy relevant VPN Clients or DNS Roaming Agents on laptops to filter content and protect the user from triggering malicious activity. DNSFilter Roaming Agent fh Implement a 5-minute lockout after 10 failed login attempts. NinjaOne RMM, Internet AccessRMM gI Activate screen lock after 12 hours of inactivity. NinjaOne RMM, Internet AccessRMM hj Deploy operating system patches as per schedule. NinjaOne RMM, Internet Access, SOPRMM Ik Install drivers according to the deployment schedule. NinjaOne RMM, Internet Access SOPRMM jl Deploy essential third-party applications per schedule. NinjaOne RMM, Internet Access, SOPRMM km Install Line of Business (LOB) applications as scheduled. NinjaOne RMM, Internet Access, SOPRMM l.n Application Allowlist blocklist N/A
      Back to top