Hardening & Configuration

OS Hardening

• Remove unnecessary services: Disable all services not required for the system's role. Each running service is an attack surface.
• Close unnecessary ports: Use netstat -an or ss -tlnp to audit listening ports; firewall or stop unneeded listeners
• Patch management: Apply OS updates promptly; automate where possible; test first in a staging environment
• Host-based firewall: Windows Firewall / iptables / nftables — even trusted internal systems need host-level controls
• SELinux / AppArmor: Mandatory access control at the OS level — restrict what processes can do even if compromised
• Secure boot: UEFI feature that verifies the OS bootloader hasn't been tampered with (uses TPM)
• Logging and auditing: Enable audit logs (Windows Event Log, Linux auditd) for security-relevant events

Security Baselines & Benchmarks

A security baseline is a documented minimum set of security controls applied consistently to a class of system.

• CIS Benchmarks: Free, consensus-driven hardening guides for Windows, Linux, macOS, cloud services, containers — cisecurity.org/cis-benchmarks
• DISA STIGs: US government hardening requirements — extremely detailed and prescriptive
• SCAP (Security Content Automation Protocol): NIST framework for automated compliance checking using OVAL, XCCDF definitions

Application Hardening

• Remove demo/test accounts and default credentials before deploying
• Disable debug modes in production (verbose error messages leak internal paths/stack traces)
• Apply principle of least privilege to service accounts
• Enable application-level TLS; disable weak cipher suites
• Validate and sanitize all user input (prevents injection attacks)
• Use parameterized queries / prepared statements (prevents SQL injection)
• Implement Content Security Policy (CSP) headers (prevents XSS)

Network Device Hardening

• Change default management credentials on all switches, routers, APs
• Disable Telnet; use SSH v2 only
• Disable HTTP management interface; use HTTPS
• Use SNMPv3 (authenticated + encrypted); disable v1/v2c
• Enable port security on switches (limit MACs per port; shutdown on violation)
• Disable unused switch ports and assign them to a dead VLAN
• Enable Dynamic ARP Inspection (DAI) and DHCP Snooping
• Use out-of-band management network for device access

Mobile Device Hardening

• Require passcode/biometric lock with short timeout
• Enable full device encryption
• Configure remote wipe capability
• Disable unused radios (Bluetooth, NFC, Wi-Fi) when not needed
• Only install apps from official stores; disable sideloading
• Apply MDM (Mobile Device Management) policy
• Ensure OS is updated (carrier-delayed updates are a risk on Android)

Hardening Specialized Systems

• ICS/SCADA: Segment from corporate network; use data diodes; restrict physical access
• HVAC/BAS (Building Automation): Separate network segment; change defaults
• Printers/Copiers: Change defaults, disable unused protocols (FTP, Telnet), enable encryption, configure audit logs
• VoIP systems: Separate voice VLAN; enable encryption (SRTP); prevent toll fraud