An up-to-date and properly configured operating system does not behave at all like a neglected system in the face of an intrusion attempt. The NIS2 directive now imposes on the concerned entities formalized procedures for managing security patches: testing before deployment, verification of integrity and provenance, documented compensatory measures in case a patch cannot be applied.
This regulatory tightening changes the way daily protection of a workstation is approached, far beyond the simple reflex of “updating when Windows prompts.”
AI-driven EDR and XDR: What Changes on the Workstation
Traditional antivirus solutions compare files to a database of known signatures. EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) solutions work differently: they analyze behaviors in real-time, correlate events from multiple sources (endpoint, network, messaging, cloud), and trigger automated responses.
Since 2024, the integration of generative AI models into these tools has accelerated the detection of unprecedented threats. An AI-driven EDR does not just block a suspicious executable: it identifies a chain of abnormal actions (privilege escalation followed by unusual network access, for example) and isolates the workstation before propagation.
To delve deeper into the network and software configuration of a workstation, the net tips on Geek Flare detail several useful system settings for daily use.
| Criterion | Traditional Antivirus | EDR/XDR with AI |
|---|---|---|
| Detection Method | Known Signatures | Behavioral Analysis + Multi-source Correlation |
| Response to Unknown Threats | Limited (depends on database updates) | Proactive Detection through Learning |
| Coverage Scope | Local Files | Endpoint, Network, Cloud, Messaging |
| Automated Response | File Quarantine | Workstation Isolation, Lateral Blocking, Contextual Alert |
| Compliant with NIS2 | Partially | Yes (traceability, logging, compensatory measures) |
Patch Management According to NIS2: Concrete Requirements
The NIS2 directive is not limited to recommending updates. It imposes a structured process that every concerned entity must be able to document.
Test Before Deploying
Every patch must be systematically tested before its deployment in production. A patch that fixes a vulnerability can also break a business application. The regulatory framework requires that this risk be formally assessed, not simply assumed to be acceptable.
Verify Integrity and Provenance
Downloading a patch from an unofficial mirror or a link forwarded by email exposes to the injection of malicious code. NIS2 requirements impose a verification of the integrity and provenance of each patch, which implies checking digital signatures and using only the official distribution channels of the publisher.
Document Compensatory Measures
When a patch cannot be applied (software incompatibility, legacy system), the entity must implement and document compensatory measures: network segmentation, access restriction, enhanced monitoring of the affected workstation. The absence of a patch does not exempt from protection.
Securing the Operating System Daily: Underestimated Settings
Competing guides list generic practices (passwords, backups, caution with emails). Three less visible settings have a measurable impact on the attack surface of a workstation.
- Disable Unused Network Protocols: SMBv1, NetBIOS over TCP/IP, and LLMNR remain enabled by default on many Windows installations. Each of these protocols constitutes a documented lateral attack vector. Disabling them takes a few minutes in the advanced network settings.
- Restricting execution permissions through Software Restriction Policies (SRP) or AppLocker allows you to block the execution of any program not explicitly authorized. This whitelisting principle drastically reduces the risk of executing ransomware inadvertently downloaded.
- Enabling full disk encryption (BitLocker on Windows, LUKS on Linux, FileVault on macOS) protects data in case of physical theft of the workstation. Without the decryption key, the disk remains unreadable even when mounted on another machine.
Separation of Personal and Professional Uses: Impact on the Attack Surface
Using the same workstation or account for personal and professional activities multiplies entry points. A browser with unvetted personal extensions, an email client connected to a private account, a USB stick used interchangeably on multiple machines: each intersection creates a potential breach.
The recommendation from ANSSI (National Cybersecurity Agency of France) is explicit: do not connect personal devices to the entity’s network, do not use your professional address for personal registrations. However, the strict separation of user accounts on the same workstation (a dedicated administrator profile, a standard user profile for daily use) remains the simplest lever to implement and is often overlooked.
Working permanently with an administrator account is akin to leaving all doors open. Malware executed under a limited rights account cannot modify system files, install a persistent service, or disable existing protections.
The combination of a modern EDR, rigorous patch management compliant with the NIS2 framework, and targeted system settings (disabled protocols, execution whitelist, disk encryption, account separation) constitutes a significantly stronger daily protection foundation than merely accumulating generic best practices. This structured approach is no longer optional but legally required for entities concerned by NIS2.