In the current threat climate, a "wait and see" approach to security is a strategy for failure. At NOCTeam, we have already begun the proactive rollout of Microsoft Baseline Security rules across our client base.
These baselines represent a fundamental shift from manual configuration to a "Secure by Default" posture, closing the legacy gaps that modern attackers exploit most frequently.
The Anatomy of the Baseline - What’s Being Hardened?
Our recent audits identify several critical areas where "At Risk" settings are being transitioned to "Meets Standard".
Here is a detailed look at the core rules we are enforcing,
- Authentication & Protocol Hardening
Attackers love legacy protocols because they often bypass Multi-Factor Authentication (MFA).
- Blocking Exchange Web Services (EWS) - This prevents older applications from accessing your mail data via insecure, legacy methods.
- Restricting IDCRL & FPRPC Protocols - These obscure protocols are often used by legacy SharePoint and Office tools; blocking them closes "side-door" entry points for credential theft.
- Blocking New Password Credentials in Apps - This encourages the use of modern, token-based authentication (like OAuth) rather than storing vulnerable passwords within third-party apps.
- Advanced File Protection
Microsoft 365 apps are a primary delivery vector for malware. We are disabling features that offer high utility to hackers but low value to modern users.
- Legacy Formats in Protected View - Files from the "ancient" era (pre-2007) are forced into a read-only sandbox. Users must convert them to modern formats to edit, stripping away potential embedded exploits.
- ActiveX & OLE Object Blocking - These 90s-era features allow different apps to "talk" to each other, but they are frequently abused to launch malicious code from within a document.
- DDE Server Launch Block (Excel) - Dynamic Data Exchange (DDE) can be weaponised to force Excel to download and run malware without a single macro being enabled.
- Blocking Microsoft Publisher - Due to its declining use and legacy codebase, we are disabling Publisher to reduce the overall software attack surface.
- Cloud Integrity (SharePoint & OneDrive)
The cloud is only as secure as the code running within it.
- Disallowing Custom Scripts - We are blocking the ability to inject unverified scripts into SharePoint sites, preventing "Cross-Site Scripting" (XSS) attacks.
- Removing Microsoft Store Access - This prevents users from self-installing unvetted third-party add-ins that could potentially leak corporate data.
Why NOCTeam is Leading the Rollout
Security shouldn't be a project you "get around to", it should be the foundation of your operations. By enforcing these baselines now, we are significantly reducing the likelihood of successful phishing, ransomware, and account takeover attempts for our clients.
We understand that these changes can introduce friction, particularly with legacy spreadsheets or older file types. That is why our team manages the transition, identifying impacted workflows before they become a bottleneck.
Is your organisation still running on "At Risk" defaults? Don't wait for the next major exploit to harden your defences. Let us bring your environment up to the 2026 gold standard.
Contact us - [email protected]
Originally published on LinkedIn.