Complete Guide to Systems Hardening [Checklist]

Learn how systems hardening methods help to protect your networks, hardware, and valuable data by reducing your overall threat profile.

Cybersecurity has become one of the hottest topics in both the information technology and the business worlds, but the subject can seem fairly overwhelming to the average business owner or C-level executive. Cybersecurity is a complex subject after all, and simply understanding a handful of advanced security protocols or a set of compliance standards can be challenging.

Thankfully, cybersecurity is a layered practice, and we can understand a great deal about protecting an organization by looking at one of the layers right at the surface: systems hardening. Systems hardening sets the groundwork for a secure IT infrastructure — akin to “cleaning house” before moving in all of the more advanced tools and protocols that make up a total security strategy. 

What this post will cover:

• What does systems hardening mean?
• Why is systems hardening important?
• Systems hardening standards and best practices
• The five areas of system hardening
• An example systems hardening checklist

What is systems hardening?

Systems hardening refers to the tools, methods, and best practices used to reduce the attack surface in technology infrastructure, including software, data systems, and hardware. The purpose of systems hardening is to reduce the overall “threat profile” or vulnerable areas of the system. Systems hardening involves the methodical auditing, identification, and remediation of potential security vulnerabilities throughout an organization, often with an emphasis on adjusting various default settings and configurations to make them more secure.  

With system hardening, the objective is to eliminate as many security risks as possible. By minimizing the attack surface, bad actors have fewer means of entry or potential footholds for initiating a cyberattack.

The attack surface is defined as a combination of all the potential flaws and backdoors in technology that could be exploited. These vulnerabilities typically include:

• Default passwords or credentials stored in accessible files
• Unpatched software and firmware 
• Unencrypted data 
• Poorly configured infrastructure devices
• Failure to correctly set user permissions
• Improperly set cybersecurity tools

What are the benefits of systems hardening?

Systems hardening is an essential function for both security and compliance and a crucial part of a broader information security strategy. The most clear benefit of systems hardening is the reduced risk of cyber attacks and associated downtime and regulatory penalties. 

From a security standpoint, system hardening is an excellent priority to embrace before/alongside deploying security solutions such as EDR tools. After all, using such solutions on poorly configured systems is like installing window bars and security cameras on a home, but failing to close the back door. Regardless of how advanced the security tools may be, an unhardened system will likely still have vulnerabilities that make bypassing these measures possible.

System hardening must be considered throughout the IT lifecycle, from initial installation, through configuration, maintenance, and to end-of-life. Systems hardening is also mandated by all major compliance frameworks, such as PCI, DSS, and HIPAA.

5 types of systems hardening

Although the definition of system hardening applies throughout an organization’s IT infrastructure, there are several subsets of the idea that require different approaches and tools. 

1) Network hardening

Network devices are hardened to counter unauthorized access into a network’s infrastructure. In this type of hardening, vulnerabilities in device management and configurations are sought out and corrected to prevent their exploitation by bad actors who wish to gain access to the network. Increasingly, hackers use weaknesses in network device configurations and routing protocols to establish a persistent presence in a network rather than attacking specific endpoints.

2) Server hardening

The server hardening process revolves around securing the data, ports, components, functions, and permissions of a server. These protocols are executed systemwide on the hardware, firmware, and software layers.

3) Application hardening

Application hardening is centered around software installed on the network. A large aspect of application hardening — sometimes called software hardening or software application hardening — is patching and updating vulnerabilities. Again, patch management through automation is often a key tool in this approach.

Application hardening also involves updating or rewriting application code to further enhance its security, or deploying additional software-based security solutions.

4) Database hardening

Database hardening centers on reducing vulnerabilities in digital databases and database management systems (DBMS). The goal is to harden repositories of data, as well as the software used to interact with that data.

5) Operating system hardening

Operating system hardening involves securing a common target of cyberattack — a server’s operating system (OS). As with other types of software, hardening an operating system typically involves patch management that can monitor and install updates, patches, and service packs automatically.

What are the best practices for systems hardening?

Begin with planning out your approach to systems hardening. Hardening an entire network can seem daunting, so creating a strategy around progressive changes is usually the best way to manage the process. Prioritize risks identified within your technology ecosystem and use an incremental approach to address the flaws in a logical order.

Address patching and updating immediately. An automated and comprehensive patch management tool is essential for systems hardening. This step can usually be executed very quickly and will go a long way toward closing off potential entry points.

Network hardening best practices

• Ensure your firewall is properly configured and that all rules are regularly audited and updated as needed
• Secure remote access points and remote users
• Block any unnecessary network ports
• Disable and remove unused or extraneous protocols and services
• Encrypt network traffic
• Free resource: PowerShell script for conducting external port scanning from CyberDrain

Server hardening best practices

• All servers should be established in a secure data center
• Harden servers before connecting them to the internet or external networks
• Avoid installing unnecessary software on a server
• Compartmentalize servers with security in mind
• Use the principle of least privilege when setting up superuser and administrative roles
• Free resource: Endpoint Hardening Checklist
• Free resource: Windows Server Hardening Checklist from Netwrix

Application hardening best practices

• Remove unnecessary components or functions
• Restrict access to applications based on user roles and context
• Remove or reset default passwords
• Audit software integrations and remove unnecessary integrations or privileges
• Free resource: Hardening Microsoft Office 365 guide from the Australian Cyber Security Centre

Database hardening best practices

• Use access control and permissions to limit what users can do in a database
• Remove unused accounts
• Turn on node checking for user verification
• Encrypt data in transit and at rest
• Enforce secure passwords

Operating system hardening best practices

• Use a patch management tool to apply OS updates and patches automatically
• Remove unnecessary drivers, software, and services
• Encrypt local storage
• Limit registry and other systems permissions
• Log appropriate activity, errors, and warnings
• Free resource: How to manage BitLocker disk encryption remotely
• Free resource: Windows Logging Cheat Sheet

 

In addition to the above, it’s worth reiterating that finding and removing unnecessary accounts and privileges throughout your IT infrastructure is key to effective systems hardening.

And, when in doubt, CIS. All the major compliance frameworks, including PCI-DSS and HIPAA, point to CIS Benchmarks as the accepted best practice. As a result, if your organization needs to be compliant with one or more frameworks, adhering to CIS Benchmarks is required. Learn more about the CIS Benchmarks and CIS Controls.

Example systems hardening checklist

Network hardening

• Firewall configuration
• Regular network auditing
• Limit users and secure access points
• Block unused network ports
• Encrypt network traffic
• Disallow anonymous access

Server hardening

• Review and allocate administrative access and rights (least privilege)
• Servers are located in a secure data center
• Disallow shutdown initiation without verification
• Remove unnecessary software

Application hardening

• Set application access control
• Automate patch management
• Remove default passwords
• Implement password hygiene best practices
• Configure account lockout policies

Database hardening

• Implement admin restrictions on access
• Encrypt data in transit and at rest
• Enable node checking
• Remove unused accounts

Operating system hardening

• Apply necessary updates and patches automatically
• Remove unnecessary files, libraries, drivers, and functionality
• Log all activity, errors, and warnings
• Set user permissions and group policies
• Configure file system and registry permissions

How can NinjaOne help?

NinjaOne is a powerful, easy-to-use remote monitoring and management platform that provides a single-pane-of-glass view into all the endpoints within an organization, and all the tools IT teams need to improve delivery. Our platform simplifies and automates the day-to-day work of managed service providers and IT professionals so they can focus on complex, value-added services, end-user relationships, and strategic projects.

• Month to month: no long-term contracts
• Flexible per-device pricing
• Free and unlimited onboarding
• Free and unlimited training
• Ranked #1 in support