Blue team / defensive security
System Hardening
Overview
System hardening secures how computers, servers, network devices, applications, and cloud services are configured, shrinking the attack surface and making attacks harder to pull off.
Key concepts
- Patch management, secure configuration
- Allowlisting/blocklisting, service hardening
- Configuration baseline vs. drift
- Network segmentation
How it works
System hardening is the process of securely configuring computers, servers, network devices, applications, and cloud services to reduce unnecessary exposure and make attacks more difficult — shrinking the attack surface so there are fewer openings for an attacker to exploit.
Account & access hardening
| Term | Meaning |
|---|---|
| Default credentials | Factory-set usernames/passwords that should be changed immediately — attackers often know or can guess them. |
| Multi-factor authentication (MFA) | Requires two or more forms of verification. |
| Account management | Creating, reviewing, disabling, and removing accounts so only authorized users have access. |
| Privileged account | An account with elevated permissions — administrator, root, domain admin, cloud admin. |
System & service hardening
| Term | Meaning |
|---|---|
| Patch management | Identifying, testing, and installing updates that fix security vulnerabilities. |
| Secure configuration | Configuring a device/service/app to security best practices rather than defaults. |
| Application allowlisting | Allowing only approved software to run on a system. |
| Application blocklisting | Preventing known unwanted or unauthorized software from running. |
| Service hardening | Disabling or restricting unnecessary services, protocols, ports, and remote-management features. |
| Configuration baseline | A documented, approved secure configuration used as the standard for similar systems. |
| Configuration drift | When a system gradually changes away from its approved baseline through untracked changes or manual fixes. |
| Network segmentation | Dividing a network into separate sections to limit unauthorized access and lateral movement. |
| Encryption | Converting information into unreadable data accessible only with the correct key. |
Common hardening practices
- Remove unused applications, user accounts, browser extensions, services, and network ports.
- Replace default passwords with long, unique passwords and enable MFA where possible.
- Apply OS, browser, application, firmware, and security-product updates promptly.
- Use a standard, documented secure baseline for Windows, Linux, routers, switches, cloud accounts, and web servers.
- Restrict administrative access to only trusted users, devices, and management networks.
- Disable older or insecure protocols, such as Telnet and unencrypted FTP.
- Encrypt laptops, removable storage, backups, and sensitive data.
- Keep secure backups protected from unauthorized changes or ransomware.
- Review firewall rules and remove ones that expose services unnecessarily.
- Separate guest Wi-Fi, employee devices, servers, admin systems, and internet-facing services into different network segments.
- Most important: keep auditing and checking system security — as more patches roll out, devices that used to be safe can develop new vulnerabilities.