{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/hardening","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/hardening/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/hardening/"},"term":{"en":"Hardening","da":"Hærdning (hardening)"},"aka":{"en":["system hardening","secure configuration"],"da":["sikker konfiguration"]},"domain":["security"],"cluster":"controls","layer":"host","status":"current","summary":{"en":"Making a system harder to attack by turning off what is not needed and changing unsafe default settings.","da":"At gøre et system sværere at angribe ved at slå det unødvendige fra og ændre usikre standardindstillinger."},"body":{"formal":{"en":"The practice of reducing the ways into a system by removing unused software and services, closing unused ports, changing default passwords and applying a written safe setup, often taken from a published guide.","da":"Praksis, hvor man mindsker antallet af veje ind i et system ved at fjerne overflødig software og tjenester, lukke unødvendige porte, skifte standardadgangskoder og anvende en nedskrevet sikker opsætning, ofte hentet fra en offentlig vejledning."},"plain":{"en":"Like moving into a new house and changing the locks, bricking up a door you never use and taking the spare key out from under the mat.","da":"Som at flytte ind i et nyt hus og skifte låsene, mure en dør til, man aldrig bruger, og fjerne reservenøglen under måtten."},"inPractice":{"en":"Before a ministry's new web server goes live, the IT operations team removes the sample pages, turns off file sharing from outside, changes the default admin password and checks the setup against a CIS guide.","da":"Før et ministeriums nye webserver går i drift, fjerner IT-driften eksempelsiderne, slår fildeling udefra fra, skifter administratorens standardadgangskode og tjekker opsætningen mod en CIS-vejledning."},"whyItMatters":{"en":"Systems often ship set up for ease rather than safety, and attackers know the default settings well; every unneeded service left running is one more way in.","da":"Systemer leveres ofte sat op til at være nemme frem for sikre, og angribere kender standardindstillingerne godt; hver unødvendig tjeneste, der kører, er endnu en vej ind."}},"deepDive":{"en":"Hardening is attack-surface reduction applied through configuration: every listening service, enabled protocol, installed package, default account and permissive setting is a potential entry point or escalation path, so the baseline removes or restricts whatever the system's role does not need. It is normally driven by a published benchmark rather than invented locally. The main sources are the CIS Benchmarks (consensus guides per product with Level 1 profiles meant to be broadly safe and Level 2 profiles for higher-security environments that may break functionality), the US DISA Security Technical Implementation Guides (STIGs), vendor baselines such as the Microsoft Security Compliance Toolkit, and the NIST National Checklist Program described in SP 800-70. SP 800-123 remains the general NIST guide to server hardening, though dated.\n\nTypical Windows items: disable SMBv1, LLMNR and NetBIOS name resolution (used for credential relaying), enforce SMB and LDAP signing, restrict NTLM, randomise local administrator passwords with LAPS, enable Credential Guard and attack surface reduction rules, and limit PowerShell to constrained language mode where application control is in force. Typical Linux items: disable root login and password authentication in sshd, remove compilers and unused daemons from production hosts, set kernel parameters via sysctl (for example restricting ptrace and unprivileged BPF), mount /tmp with noexec, and enforce SELinux or AppArmor. For containers and Kubernetes: run as non-root with a read-only root filesystem, drop Linux capabilities, apply a seccomp profile, forbid privileged pods and host path mounts, and enforce the Kubernetes Pod Security Standards (privileged, baseline, restricted) at namespace level.\n\nMachine-readable formats make baselines auditable: SCAP bundles XCCDF checklists and OVAL checks, and tools such as OpenSCAP, CIS-CAT or cloud posture management services score systems against them. The practical challenge is drift - hand-fixed servers slide back as administrators change settings - so mature organisations encode the baseline as code (Group Policy, Ansible, DSC, Terraform policies, admission controllers) and continuously measure compliance. Every deviation should be a documented exception with a risk owner, because some hardening items break legacy applications.\n\nHardening is distinct from patching: patching fixes defects in code that must run, hardening removes or restricts code and settings that need not be exposed. CIS Controls v8 Control 4 (secure configuration of enterprise assets and software) and ISO/IEC 27002:2022 control 8.9 (configuration management), which is new in the 2022 edition, are the usual control anchors.","da":"Hærdning er reduktion af angrebsfladen gennem konfiguration: hver lyttende tjeneste, aktiveret protokol, installeret pakke, standardkonto og lempelig indstilling er et muligt indgangs- eller eskaleringspunkt, så baseline fjerner eller begrænser alt, systemets rolle ikke kræver. Arbejdet styres normalt af en offentliggjort benchmark frem for lokalt opfundne regler. De vigtigste kilder er CIS Benchmarks (konsensusvejledninger pr. produkt med Level 1-profiler, der er tænkt som bredt sikre, og Level 2-profiler til miljøer med højere sikkerhedskrav, som kan bryde funktionalitet), de amerikanske DISA Security Technical Implementation Guides (STIG'er), leverandørbaselines som Microsoft Security Compliance Toolkit og NIST's National Checklist Program beskrevet i SP 800-70. SP 800-123 er stadig NIST's generelle vejledning i serverhærdning, om end den er ældre.\n\nTypiske punkter på Windows: slå SMBv1, LLMNR og NetBIOS-navneopslag fra (bruges til relay af legitimationsoplysninger), kræv SMB- og LDAP-signering, begræns NTLM, randomisér lokale administratoradgangskoder med LAPS, aktivér Credential Guard og attack surface reduction-regler, og begræns PowerShell til constrained language mode, hvor der er applikationskontrol. Typiske punkter på Linux: slå root-login og adgangskodeautentificering fra i sshd, fjern compilere og ubrugte dæmoner fra produktionsservere, sæt kerneparametre med sysctl (fx begrænsning af ptrace og uprivilegeret BPF), montér /tmp med noexec, og håndhæv SELinux eller AppArmor. For containere og Kubernetes: kør som ikke-root med skrivebeskyttet rodfilsystem, fjern Linux capabilities, anvend en seccomp-profil, forbyd privilegerede pods og hostPath-monteringer, og håndhæv Kubernetes Pod Security Standards (privileged, baseline, restricted) på namespace-niveau.\n\nMaskinlæsbare formater gør baselines reviderbare: SCAP samler XCCDF-tjeklister og OVAL-tjek, og værktøjer som OpenSCAP, CIS-CAT eller cloud security posture management scorer systemer op imod dem. Den praktiske udfordring er drift - håndrettede servere glider tilbage, efterhånden som administratorer ændrer indstillinger - så modne organisationer udtrykker baseline som kode (Group Policy, Ansible, DSC, Terraform-politikker, admission controllers) og måler overholdelsen løbende. Hver afvigelse bør være en dokumenteret undtagelse med en risikoejer, fordi visse hærdningspunkter bryder ældre applikationer.\n\nHærdning er noget andet end patching: patching retter fejl i kode, der skal køre, mens hærdning fjerner eller begrænser kode og indstillinger, der ikke behøver at være eksponeret. CIS Controls v8 Control 4 (sikker konfiguration af virksomhedens aktiver og software) og ISO/IEC 27002:2022 kontrol 8.9 (konfigurationsstyring), som er ny i 2022-udgaven, er de sædvanlige kontrolankre."},"edges":[{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/vulnerability","why":{"en":"Removing what is not needed removes the weaknesses that come with it.","da":"Når man fjerner det, der ikke er brug for, forsvinder de svagheder, der følger med."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"platform/cloud-misconfiguration","confidence":"high","strength":"normal"},{"type":"mitigates","to":"platform/container-escape","why":{"en":"Running containers without admin rights, without the host's disks and with a patched kernel removes most of the ways out.","da":"At køre containere uden administratorrettigheder, uden værtens diske og med en opdateret kerne fjerner de fleste veje ud."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/secure-boot","why":{"en":"Hardening removes needless ways into a running system; secure boot makes sure the system that starts is the untouched one.","da":"Hærdning fjerner unødvendige veje ind i et kørende system; secure boot sikrer, at det system, der starter, er det uberørte."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/patch-management","why":{"en":"Hardening closes doors that are not needed; patching fixes flaws in the ones that must stay open.","da":"Hærdning lukker døre, der ikke er brug for; patching retter fejl i dem, der skal forblive åbne."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/infrastructure-as-code","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"CIS Controls v8 - Control 4 (Secure Configuration of Enterprise Assets and Software)","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST SP 800-123 - Guide to General Server Security","tier":"standard","publisher":"NIST"}],"draft":true}