Heh, it's my habit to ask questions like this
Stick around security folks long enough and you'll hear reference to "the
principle of least privilege." Users/computers/processes should have only
the necessary privileges to complete their work. This is a time-honored
notion.
A corollary is "the principle of minimal security." It can be very easy to
apply too many security controls to something. The temptation to enable some
security setting just because it's there is often very great. It's at times
like these where one should step back, evaluate risks and consider threats,
and then decide if it really makes sense to enable the setting. And in many
cases, it doesn't.
To the question, "How much security do you need?" the answer is, "Just
enough." The difficult part, of course, is determining what "just enough" is
for you. Security configuration guides can help, but ultimately only you can
answer the question.
--
Steve Riley
(e-mail address removed)
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com
