Hospitality Endpoint Hardening
MSP Accountability · PCI DSS v4.0

The Situation

A hospitality client came to Barr Cyber because the computer used by their General Manager to run day-to-day operations — including access to their booking and payment system — had stopped working reliably. The machine was overheating, shutting down unexpectedly, and had developed file system errors that made normal use impossible.

The client had an existing IT service provider (MSP) on contract. That provider was supposed to be actively monitoring their systems and keeping them healthy. The General Manager reached out to Barr Cyber when the situation had deteriorated to the point where the machine was no longer usable.

What Barr Cyber Found

What Was Applied & Why It Matters

Each configuration below closes a specific, documented attack path with a known business cost. These are not abstract security measures — every line maps to a CVE, a MITRE ATT&CK technique, and a published breach cost figure.

What Was Done

Barr Cyber deployed a replacement workstation and built it from scratch — clean operating system install, no inherited software or configuration from the prior environment. Every security configuration was applied deliberately and documented with command-level evidence.

Key Protections Applied

Why This Hardening Configuration Matters

A standard Windows install is not a secure workstation. Out of the box, Windows ships with legacy protocols enabled, default account names that attackers know to target, no enforced password policy, no audit logging, and remote access either wide open or completely absent. Most workstations deployed by IT providers are never hardened beyond basic setup — they are functional, but they are not defended.

What was built here is a different standard. Every configuration applied was chosen because it closes a specific, documented attack path. This is not checkbox security — it is a deliberate defensive posture built for a machine that handles booking data, payment system access, and remote management by the General Manager.

The Value of PCI DSS Compliance

PCI DSS is not bureaucratic overhead — it is a practical security framework built from decades of documented breaches. Every requirement in it exists because a specific class of attack caused real financial damage at real businesses. When Barr Cyber applies these configurations, it is not filling out a compliance checklist. It is closing the exact attack vectors that PCI DSS was written to address.

The configurations applied to this workstation satisfy six specific PCI DSS v4.0 requirements with documented evidence for each. This documentation can be presented directly to a QSA, an acquiring bank, or legal counsel. If something goes wrong and there is ever a question about whether this business took reasonable steps to protect cardholder data, this report is the answer.

Engagement Timeline

Hardware & Configuration

Hardware Diagnostic Results — Dell SupportAssist

Full Configuration — Command Level

Applied in order. All commands run in PowerShell as administrator unless noted. Post-reboot verification confirms persistent state. Every command, result, and status is documented exactly as executed.

Account & Access Hygiene

Default account names and stale credentials are among the most common entry points in workstation attacks. PCI DSS Req 2.2, 8.2, 8.3.

Attack Surface Reduction

Legacy protocols left enabled on modern systems are a known attacker toolbox. SMBv1 is the vector behind EternalBlue. PSv2 bypasses modern logging and AMSI. PCI DSS Req 2.2.4.

Firewall

Default-deny inbound policy means no unsolicited inbound connection can reach this machine from any network — local LAN, internet, or otherwise. RDP disabled on the public interface and re-enabled exclusively on the Tailscale tunnel after enrollment. PCI DSS Req 1.3.1, 1.3.2, 1.4.1.

Wireless Lockdown

WLAN service disabled at both service and registry level. No wireless adapter present, but both layers locked to prevent future hardware additions from inadvertently enabling wireless. PCI DSS Req 1.3.2, 2.2.4.

Remote Access — Tailscale VPN

Remote access to a PCI-scope machine must never be exposed to the public internet. Tailscale provides an encrypted overlay using WireGuard — only enrolled, authenticated devices on the tailnet can initiate a connection. No port forwarding. No public-facing attack surface. PCI DSS Req 1.4.1, 7.2.1, 8.3.1.

Audit Logging

Without audit logging, there is no record of who logged in, what accounts were changed, or whether security policies were modified. Logging policy changes means any attempt to disable logging will itself generate a log entry. PCI DSS Req 10.2.1, 10.2.2, 10.3.3.

Credential Protection — LSASS

LSASS handles Windows authentication and stores credential material in memory. Tools like Mimikatz target it directly. Running LSASS as a Protected Process Light significantly raises the bar. On a fully patched Windows 11 system, most known userland bypass techniques have been closed by Microsoft. Determined attackers with BYOVD capability can bypass PPL, but this substantially increases attack complexity and detection surface. PCI DSS Req 8.3, 8.6.

Network Poisoning Vectors — LLMNR, NetBIOS, WPAD

LLMNR and NetBIOS can be exploited by tools like Responder to intercept authentication attempts and capture credential hashes — even on a machine that has never visited a malicious site. WPAD allows an attacker on the same network to redirect all web traffic through a proxy they control. All three disabled. PCI DSS Req 1.3, 2.2.4.

Secure DNS — Quad9

DNS is the first step in nearly every network connection. Quad9 (9.9.9.9) provides malicious domain blocking at the resolver level — known malware C2 domains, phishing sites, and malicious infrastructure are blocked before a connection is ever made. PCI DSS Req 1.3, 6.3.

Windows Defender & Exploit Protection

Real-time protection, cloud-delivered threat intelligence, and system-wide exploit mitigations enforced explicitly rather than left at defaults. PCI DSS Req 5.2, 6.3.

PrintNightmare Mitigation

CVE-2021-34527 (CVSS 8.8 HIGH) allows RCE via Print Spooler. Printing confirmed required by manager — Spooler not disabled. PointAndPrint restriction applied instead. This machine must remain current on Windows Updates for the registry restriction to remain effective. PCI DSS Req 2.2.4.

PowerShell Constrained Language Mode

CLM restricts PowerShell to a safe subset, significantly raising the cost of LOTL attacks. Not a hard barrier against compiled binaries or .NET, but eliminates the majority of automated and opportunistic PowerShell-based attack paths. Note to future MSP: CLM is active (value 4). Some admin scripts will fail — lift temporarily to 0, run, restore to 4. PCI DSS Req 2.2.4, 6.3.

Secure Boot — Finding & Remediation

Secure Boot status is verified early in the session as a baseline check. On this machine it was found disabled in firmware — a configuration gap that allows unsigned bootloaders and rootkits to execute before the OS loads. Remediated in-session via BIOS. PCI DSS Req 2.2.4.

Post-Reboot Verification

Several configurations — notably LSASS PPL — require a reboot to take effect. Post-reboot verification confirms all critical settings survived the restart and are active in their final persistent state. This is the definitive check: not what was configured, but what is actually running.

MSP Monitoring Not Actively Functioning

Six Requirements — Command-Level Evidence

Each of the following requirement blocks documents what PCI DSS requires, the specific commands applied as evidence, and how the current configuration satisfies each requirement. This section is suitable for presentation to a QSA, acquiring bank, or legal counsel.

CVE & MITRE ATT&CK Techniques

All CVEs listed are confirmed as Known Exploited Vulnerabilities in the CISA KEV catalog unless noted. MITRE ATT&CK techniques where no CVE exists are protocol design weaknesses or configuration abuses — not patchable, only configurable.

Complete

Notes for Future MSP

Download Complete Case Study

The full case study document includes both Part 1 (business-owner summary) and Part 2 (complete technical appendix) — the full hardening command sequence with results, PCI DSS v4.0 compliance mapping with QSA-presentable evidence, MSP monitoring finding documentation, CVE & MITRE ATT&CK reference, and engagement timeline. 21 pages. Print-ready.