Hardening

Hardening is attack-surface reduction applied through configuration: every listening service, enabled protocol, installed package, default account and permissive setting is a potential entry point or escalation path, so the baseline removes or restricts whatever the system's role does not need. It is normally driven by a published benchmark rather than invented locally. The main sources are the CIS Benchmarks (consensus guides per product with Level 1 profiles meant to be broadly safe and Level 2 profiles for higher-security environments that may break functionality), the US DISA Security Technical Implementation Guides (STIGs), vendor baselines such as the Microsoft Security Compliance Toolkit, and the NIST National Checklist Program described in SP 800-70. SP 800-123 remains the general NIST guide to server hardening, though dated.

Typical Windows items: disable SMBv1, LLMNR and NetBIOS name resolution (used for credential relaying), enforce SMB and LDAP signing, restrict NTLM, randomise local administrator passwords with LAPS, enable Credential Guard and attack surface reduction rules, and limit PowerShell to constrained language mode where application control is in force. Typical Linux items: disable root login and password authentication in sshd, remove compilers and unused daemons from production hosts, set kernel parameters via sysctl (for example restricting ptrace and unprivileged BPF), mount /tmp with noexec, and enforce SELinux or AppArmor. For containers and Kubernetes: run as non-root with a read-only root filesystem, drop Linux capabilities, apply a seccomp profile, forbid privileged pods and host path mounts, and enforce the Kubernetes Pod Security Standards (privileged, baseline, restricted) at namespace level.

Machine-readable formats make baselines auditable: SCAP bundles XCCDF checklists and OVAL checks, and tools such as OpenSCAP, CIS-CAT or cloud posture management services score systems against them. The practical challenge is drift - hand-fixed servers slide back as administrators change settings - so mature organisations encode the baseline as code (Group Policy, Ansible, DSC, Terraform policies, admission controllers) and continuously measure compliance. Every deviation should be a documented exception with a risk owner, because some hardening items break legacy applications.

Hardening is distinct from patching: patching fixes defects in code that must run, hardening removes or restricts code and settings that need not be exposed. CIS Controls v8 Control 4 (secure configuration of enterprise assets and software) and ISO/IEC 27002:2022 control 8.9 (configuration management), which is new in the 2022 edition, are the usual control anchors.