Roger Grimes: After 20-plus years of giving hardening advice, I realized I was wrong. Grimes: In general, there is very little evidence to support the case that a company tightening Windows beyond Microsoft’s recommendations experiences any significant benefit. Good security is all about risk management and cost/benefit trade-off, Grimes says. Most of the buffer overflows you read about are only considered “remotely” exploitable in that gaining access to inside resource from outside the network requires tricking an end-user into clicking on something.”]