2. If a bad guy can alter the operating system on your computer, it's not your computer anymore A bad guy could have altered the operating system on EVERY computer on your network

10. Rebuild host Remove known malware Decommission Create new account Reset password Delete account

11. Host options are customer and target dependent Upgrade OS and apps to latest version Disable or randomize local administrator Block workstation to workstation comms Block admin Internet access Block servers from connecting to the Internet Applocker for whitelisting on server Disable remote service install Disable event log clearing Enforce interactive logon with smart cards Remove “Everyone” access from the network Account options Increase password complexity for service/admin accounts Two-factor auth* Restrict which systems accounts can logon to Remove certain logon privileged (logon as service)

18. Access: Users and Workstations Power: Domain Controllers Data: Servers and Applications

19. Domain Admins Enterprise Admins Admins