What is user application hardening?
Where it stops an attack.
- The attack A malicious web ad or document tries to launch another program or inject code.
- Stopped here Browsers block web ads and Java, and Office and PDF software can’t start other programs.
- The result The page or file has nothing to work with.
Application hardening maturity levels
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Web browsers No Java or web ads from the internetAdds ASD and vendor hardening guidance No change
Microsoft Office Not required
Can’t start programs, create executables, inject code or run OLE packages. Hardened to guidance No change
PDF software Not required
Can’t start programs. Hardened to guidance No change
Settings users can’t change Browser security settingsAdds Office and PDF settings No change
Legacy components Internet Explorer 11 off No change
Adds .NET Framework 3.5 and PowerShell 2.0 off
PowerShell Not required
Not required
Constrained Language Mode
Logging Not required
PowerShell and command-line events logged centrally. Internet-facing server logs analysedAdds analysis of workstation and internal server logs
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to harden browsers, Office and PDF software
Protection first, disruption last.
- 01
Baseline your browsers
One or two approved browsers, managed centrally, with ads and legacy plugins blocked. - 02
Turn on attack surface reduction rules
Microsoft Defender rules stop Office and PDF apps launching other programs. Audit first, then block. - 03
Remove legacy components
Internet Explorer 11, PowerShell 2.0 and old .NET Framework versions come out. - 04
Lock and log
Settings enforced by policy, with PowerShell and process events sent to a central log.
Common application hardening mistakes
Where rollouts go wrong.
-
Unmanaged browsers
A browser staff installed themselves ignores every setting.
-
Untested ASR rules
Some rules affect add-ins and line-of-business tools. Audit mode first.
-
Forgetting PDF software
Office locked down, an old PDF reader left wide open.
What are attack surface reduction (ASR) rules?
Microsoft Defender settings that block risky behaviour, such as Office starting other programs or running obfuscated scripts. Several map directly to Maturity Level 2.
Do we still need to remove Internet Explorer?
Yes. It’s unsupported, but its components remain on many Windows systems. Maturity Level 1 requires it to be disabled or removed.
Will hardening affect our line-of-business software?
Occasionally. That’s why we test in audit mode and make narrow exceptions rather than weaken settings for everyone.