Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
4.5.1. OS and Application Hardening
💡 First Principle: An unhardened OS installation includes many features enabled by default—some useful, some not needed, some actively dangerous. OS hardening systematically removes what isn't needed and strengthens what remains.
OS Hardening Checklist
| Action | Why |
|---|---|
| Disable unused services | Every running service is a potential exploit vector |
| Close unneeded ports | Every open port is a potential attack surface |
| Install only required software | Every installed application has vulnerabilities |
| Apply driver updates | Driver vulnerabilities bypass OS security |
| Apply OS updates/patches | Patches close known vulnerabilities |
| Configure firewall | Restrict inbound/outbound to only required traffic |
| Rename/disable default admin account | Default account names are well-known to attackers |
| Remove default credentials | Default passwords are public knowledge |
Application Hardening
- Install latest patches for all applications
- Disable unneeded services, roles, or features within applications
- Configure least-privilege service accounts
- Enable application-level logging
Host Security
- Antivirus/Anti-malware: Signature-based detection of known threats. Must be kept current (signatures updated regularly).
- HIDS (Host Intrusion Detection System): Monitors the host for suspicious activity (unexpected process starts, file system changes, registry modifications) and alerts. Detection only—doesn't block.
- HIPS (Host Intrusion Prevention System): Same as HIDS but actively blocks detected threats. More powerful but can cause false positive blocks of legitimate activity.
⚠️ Exam Trap: Antivirus and HIDS/HIPS are complementary, not redundant. Antivirus detects known malware signatures; HIDS detects behavioral anomalies that may indicate new or unknown threats. A fully protected server uses both.
Reflection Question: A newly deployed web server has Telnet enabled (port 23) for legacy compatibility, but Telnet is never actually used. Why is this a security risk even if no one connects to it?
Written byAlvin Varughese
Founder•18 professional certifications