Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Description
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
Security configuration management and file integrity monitoring platform with policy compliance and drift detection
Fortra (Tripwire) · Per-node subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Exploitation of Unnecessary Services
IntegrityAttackers exploit vulnerabilities in services that are running but not needed for business operations, such as unused web servers, FTP services, or remote desktop on workstations.
Attack Surface Expansion via Unused Application Modules
ConfidentialityUnnecessary application modules and service functions provide additional code paths for attackers to exploit, even though the organization never uses the functionality.
Vulnerabilities (When Safeguard Absent)
Excessive Running Services on Enterprise Assets
Systems run unnecessary services and application modules out of the box, dramatically expanding the attack surface beyond what is required for their intended function.
No Attack Surface Reduction Process
Without a process to identify and disable unnecessary services, each system accumulates exploitable services that increase risk without providing business value.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |