CompTIA Security+ Preparation · lesson 31 of 45 · 25 min
System Hardening Fundamentals
Hardening — reducing the attack surface of a system by removing unnecessary components, disabling unused services, and applying secure configurations.
Patching — applying vendor-released fixes for known vulnerabilities. Most critical hardening step. Patch management process: inventory → identify → test → deploy → verify → document.
Disabling unnecessary services — every running service is a potential attack vector. Disable Telnet, FTP, rsh, rlogin, and other legacy insecure services. Use SSH instead of Telnet, SFTP instead of FTP.
Removing unnecessary software — uninstall applications that are not needed. Reduces vulnerabilities and attack surface.
Changing default credentials — default usernames/passwords (admin/admin, admin/password) are publicly known. Change immediately on all devices.
Disabling default accounts — disable or rename built-in accounts (Administrator, Guest, root) that attackers target.
Enabling host-based firewall — Windows Firewall, iptables/nftables on Linux. Block all inbound traffic except what is explicitly needed.
Secure Baselines and CIS Benchmarks
Security baseline — minimum security configuration for a system type. All systems must meet or exceed it.
CIS Benchmarks — Center for Internet Security. Free, consensus-based security configuration guides for operating systems, cloud platforms, applications, and network devices. Two levels: Level 1 (basic, minimal impact on functionality), Level 2 (defense-in-depth, may impact functionality).
STIG (Security Technical Implementation Guide) — DoD security configuration standards. More stringent than CIS benchmarks. Used in government and military environments.
Group Policy (Windows) — centrally manage security settings across Windows systems. Configure password policies, account lockout, audit policies, software restrictions.
Configuration drift — systems gradually deviate from their secure baseline over time. Detected and corrected by configuration management tools (Ansible, Puppet, Chef).
Application control (whitelisting) — only approved applications can run. Blocks malware and unauthorized software. Tools: AppLocker (Windows), SELinux, application control in EDR.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Hardening Techniques
The most critical hardening step is:
- Renaming the Administrator account
- Applying security patches
- Enabling the screensaver
- Installing antivirus
- Answer: Applying security patches
Patching fixes known vulnerabilities — unpatched systems are the most common attack vector. Patch management is the foundation of hardening. CIS Benchmark Level 1 is described as:
- Maximum security, may impact functionality
- Basic security with minimal impact on functionality
- DoD-level security
- Only for servers
- Answer: Basic security with minimal impact on functionality
CIS Level 1: essential security settings that can be implemented without significantly impacting system functionality. Configuration drift occurs when:
- Systems are patched too frequently
- Systems gradually deviate from their secure baseline over time
- Configurations are too strict
- Baselines are updated
- Answer: Systems gradually deviate from their secure baseline over time
Drift happens through manual changes, software updates, and troubleshooting — systems slowly become less secure than their baseline. Application whitelisting (application control) blocks:
- All network traffic
- Any application not on the approved list
- Only known malware
- Only unsigned applications
- Answer: Any application not on the approved list
Whitelisting is a default-deny approach — only explicitly approved applications can execute, blocking all unknown software including new malware. STIGs are primarily used in:
- Commercial enterprises
- Government and military environments
- Small businesses
- Cloud-only environments
- Answer: Government and military environments
STIGs (Security Technical Implementation Guides) are DoD standards — required for government systems, more stringent than CIS benchmarks. Disabling Telnet and using SSH instead is an example of:
- Patching
- Replacing an insecure protocol with a secure one — a hardening technique
- Application whitelisting
- Configuration drift
- Answer: Replacing an insecure protocol with a secure one — a hardening technique
Telnet transmits data in plaintext. SSH encrypts all communications. Replacing Telnet with SSH is a fundamental hardening step. Group Policy in Windows is used to:
- Manage cloud resources
- Centrally configure security settings across Windows systems
- Scan for malware
- Monitor network traffic
- Answer: Centrally configure security settings across Windows systems
Group Policy Objects (GPOs) enforce security settings — password policies, account lockout, audit settings — across all domain-joined systems. Changing default credentials is important because:
- Default passwords are too long
- Default usernames and passwords are publicly known and widely targeted
- Vendors require it for warranty
- It improves performance
- Answer: Default usernames and passwords are publicly known and widely targeted
Attackers use lists of default credentials to compromise routers, switches, cameras, and other devices. Change them immediately. Removing unnecessary software reduces:
- System performance
- The attack surface — fewer applications means fewer potential vulnerabilities
- Network bandwidth
- User productivity
- Answer: The attack surface — fewer applications means fewer potential vulnerabilities
Every installed application is a potential vulnerability. Removing unneeded software reduces the number of CVEs that apply to the system.
CIS stands for Center for _____ Security.
Answer: Internet
CIS = Center for Internet Security — publishes free security benchmarks and controls used worldwide.
Previous lesson: Mobile device management: MDM, MAM, BYOD, containerization, remote wipe
Back to CompTIA Security+ Preparation
Next lesson: Incident response lifecycle: preparation, detection, containment, eradication, recovery