Hardening Systems

Learning outcomes:

  • Apply common hardening steps that reduce a system's attack surface, such as disabling unnecessary services, removing default accounts, and applying least privilege
  • Configure account and password policies that balance security with usability
  • Use industry benchmarks such as the CIS Benchmarks to evaluate and improve a system's configuration
  • Describe how patch management and configuration baselines keep systems hardened over time

Would you like to download my PowerPoint to follow along?

  • What Is the Attack Surface?
    • Every open port, service, account and app is a way in
    • Less running means less to attack
  • Out-of-the-Box Is Not Secure
    • Default passwords, default accounts, unneeded services
    • Vendors aim for "easy to set up", not "secure"
    • Example: IoT devices with default admin logins
  • Disabling Unnecessary Services
  • Accounts and Least Privilege
    • Remove or disable default and unused accounts
    • Don't use admin accounts for daily work
    • Give people only the access their job needs
  • Password and Account Policies
    • Length beats complexity
    • Lockout policies and MFA
    • Balancing security with usability: too strict and people write passwords on sticky notes
  • Industry Benchmarks
    • A benchmark is an expert-agreed checklist of secure settings for a specific system
    • Common sources: CIS Benchmarks, CIS Controls, DISA STIGs, and vendor baselines such as Microsoft's
    • Why use a standard instead of making it up yourself
      • Built and reviewed by experts across the industry
      • Auditors, insurers and regulations (PCI DSS, HIPAA, CMMC) expect one
      • Gives you a measurable score to track progress
    • Document exceptions when a setting breaks something you need
  • Industry Benchmarks in Detail
    • CIS Benchmarks
      • Free guides for Windows, Linux, macOS, cloud platforms, browsers and more
      • Level 1: basic settings with little impact. Level 2: stricter, for high-security systems
      • Each item explains the reason, how to check it, and how to fix it
    • CIS Controls
      • 18 prioritized practices for the whole organization, not just one system
      • Implementation Group 1 is the starting point for small organizations
    • DISA STIGs
      • Required for US Department of Defense systems and contractors
      • Findings are rated from Category I (most severe) to Category III
  • Hardening Tools
  • Patch Management
  • Configuration Baselines and Drift
    • Document what "secure" looks like for each system type
    • Systems drift over time as changes pile up
    • Use automation to check and enforce baselines
  • Hardening Your Personal Devices
  • Hardening Is Ongoing
    • New vulnerabilities and new software keep appearing
    • Schedule regular reviews
    • Document every change

Suggested Activities and Discussion Topics:

  • Activity: compare a fresh VM against a CIS Benchmark and fix three findings
  • Discussion: where should the line be between security and usability in a password policy? Have you seen a policy that went too far?
  • Activity: read the example postmortem. Which hardening steps from this week would have prevented the incident? Which action items would you do first, and why?
  • Discussion: you disable a service to harden a server, and it breaks something the business depends on. Who should decide whether the service gets turned back on? How do you document that decision?
  • Activity: harden your own phone. Go through your app permissions and turn off at least three that the app doesn't need, such as location, microphone or contacts. Share which ones surprised you.

Would you like to see some more classes? Click here