3.5.3. Hardening Techniques

💡 First Principle: Hardening removes unnecessary functionality to reduce the attack surface. A default system installation is optimized for features and compatibility, not security. Hardening transforms it into a system that does only what it needs to do, with everything else disabled.

Disabling unnecessary ports and protocols — every open port is a potential entry point. Close what isn't needed. If a server only serves web traffic, disable SSH if remote management isn't required, close all ports except 80/443, and remove unused network protocols.

Removing unnecessary software — uninstall applications that aren't required for the system's function. Each installed application is code that must be patched and may contain vulnerabilities.

Changing default passwords — factory default credentials are publicly documented. Every device must have unique, strong credentials before production deployment.

Disabling unnecessary accounts — remove or disable default accounts, guest accounts, and accounts for former employees. Each active account is a potential attack vector.

Secure baseline configuration — document and enforce a hardened configuration standard for each system role. Baselines define which services run, which ports are open, which accounts exist, and which permissions are set.

Least functionality — configure each system to provide only the essential capabilities required for its role. A web server doesn't need a desktop environment. A database server doesn't need a web browser.

Group Policy and configuration management — enterprise environments use Group Policy (Windows) or configuration management tools (Ansible, Puppet, Chef) to enforce hardened configurations across thousands of systems simultaneously. CIS Benchmarks provide pre-built, peer-reviewed hardening guides for specific operating systems and applications — following them gives a defensible baseline that aligns with industry best practices. Automated compliance scanning validates that systems remain hardened over time, catching configuration drift before it becomes exploitable.

⚠️ Exam Trap: "Hardening" and "least functionality" are closely related but distinct. Hardening is the broad process of securing a system. Least functionality is a specific principle within hardening that means removing everything not essential. If the question asks specifically about minimizing features, the answer is least functionality.