CybersecKyle Security How-To Series: Blue Team Fundamentals, Part 1 - Windows Workstation Baseline with Defender and ASR Rules

Part 1 of the Blue Team Fundamentals track in my CybersecKyle Security How-To Series moves from personal-device hygiene to a Windows baseline that can be measured, piloted, and supported.Hardening a workstation is not a contest to enable the largest number of settings. A control earns its place when it closes a relevant attack path, produces evidence that it is working, and does not break the work the device exists to perform. That last requirement is why copying an enterprise script onto one production laptop is a poor baseline method.Use a test device or a small pilot group first. Record the current state, the desired setting, how it will be deployed, the event or status that proves it worked, and the rollback. Microsoft changes names and management paths across Windows editions and management products; build around the control and evidence rather than one screenshot.Record the foundation before adding hardeningCapture these facts for each workstation:Windows edition and version:…