Why Secure Configuration Can Outlast the Zero-Day Race
Summary
The article argues that complete secure-configuration baselines can reduce attack surface before vulnerabilities are disclosed, citing SMBv1, App Installer and MFA examples while noting that hardening complements—not replaces—patching and other defenses.
Key points
- The article cites Mandiant’s M-Trends 2026 to report that exploitation of the most targeted vulnerabilities now averages seven days before public disclosure.
- It argues that configuration baselines can block abuse of risky capabilities before a vulnerability or patch exists, while patching protects only systems that receive the update.
- Disabling SMBv1 could have blocked the EternalBlue attack path used by WannaCry and NotPetya, according to the article.
- CIS added recommendations to disable Windows App Installer functionality in March 2023, before the article says attackers resumed abusing the protocol later that year.
- The article links the Midnight Blizzard intrusion at Microsoft to a legacy test account without MFA, and says CIS Microsoft 365 guidance had recommended MFA and blocking legacy authentication.
- It recommends adopting complete baselines, testing and documenting business exceptions, and measuring configuration drift; it also notes that hardening cannot fix code flaws or prevent prompt injection.
Article Details
- Topic
- How secure configuration baselines, particularly CIS Benchmarks, can reduce exposure to attacks that patching alone may not prevent.
MITRE ATT&CK
Threat Actors
FIN7Microsoft tracked FIN7 among financially motivated groups abusing the Windows App Installer protocol to deliver signed malicious packages impersonating Zoom and TeamViewer.ICE RELICIdentified in the article as an alternate name for Midnight Blizzard, which conducted an intrusion at Microsoft detected in January 2024.Midnight BlizzardNamed as the group behind an intrusion at Microsoft detected in January 2024. The article identifies APT29 as an alternate name.
Malware
NotPetyaSix weeks later NotPetya used the same vulnerability, months after the patch shipped, and caused an estimated $10 billion in global damage.WannaCryOn May 12, WannaCry tore through unpatched machines using exactly that flaw, reaching more than 200,000 computers across roughly 150 countries within a day; the UK’s National Health Service diverted ambulances and
Vendors
Products
Microsoft 365 Apps for EnterpriseMFA isn’t an OS setting, so the relevant controls live elsewhere in the family: the CIS Microsoft 365 Foundations Benchmark had called for enforcing MFA and blocking legacy authentication for years beforehand.Windows 11Real baselines are much larger: 393 Level 1 recommendations for Windows 11 and 331 recommendations for a Windows Server 2025 Member Server.Windows App Installer2023, Microsoft tracked four financially motivated groups, including FIN7, abusing the Windows App Installer (ms-appinstaller) protocol to deliver signed malicious packages impersonating Zoom and TeamViewer.Windows Server 2025Real baselines are much larger: 393 Level 1 recommendations for Windows 11 and 331 recommendations for a Windows Server 2025 Member Server.