Myth 4: Tweaks Are Necessary

Some people consider tweaks a necessity, claiming that you cannot have a secure (read "protected") system without making a bunch of tweaks. This is an oversimplification. Tweaks block things you cannot block elsewhere. For instance, if you have two systems on a home network behind a firewall, or a corporate system that has IPsec policies that only allow it to request and receive information from a few well-managed servers, tweaks are mostly not necessary to improve security. Those systems will be perfectly fine without making any tweaks.

Even on highly exposed systems, most of the tweaks are not necessary. In eWeek's Open Hack IV competition in 2002 (see http://msdn.microsoft.com/library/en-us/dnnetsec/html/openhack.asp), we built what was probably the most protected network we have ever built. In all, we made only four Registry tweaks, a couple of ACL changes, and set a password policy. The rest of the protection for those systems was based on proper network segmentation a solid understanding of the threats, turning off unneeded services, hardening Web apps and properly protecting the SQL and Web servers. Of course, this was a specialized system with very limited functionality, but it still shows that less is often more.

Proper understanding of the threats and realistic mitigation of those threats through a solid network architecture is much more important than most of the security tweaks we turn on in the name of security.