System Hardening.

Hardening turns out-of-the-box systems into resilient ones by disabling unused services, removing default accounts, applying least privilege, enforcing strong authentication, enabling encryption, configuring logging, and restricting network exposure. It applies to operating systems, applications, databases, containers, cloud services, network devices, and firmware.

Rather than inventing controls per host, practitioners adopt published baselines. The CIS Benchmarks provide consensus, versioned hardening guides for hundreds of technologies, with two profile levels; conformance can be measured automatically with CIS-CAT against the machine-readable CIS Controls. In U.S. government and defence contexts, DISA STIGs are mandatory, distributed as SCAP content and audited with tools such as OpenSCAP. Broader control catalogues include NIST SP 800-53 and the server-focused NIST SP 800-123. Rather than click through settings by hand, teams codify the baseline as Ansible, Chef, or Puppet and continuously enforce it, preventing configuration drift.

Hardening complements — but never replaces — patching: even a fully patched host can be exploited if it exposes an anonymous share, keeps a debug endpoint open, or runs an unnecessary interpreter. Defense-in-depth pairs a hardened baseline with monitoring so that deviations are detected and reverted.

flowchart TB
  A[Default system<br/>broad attack surface] --> B[Select baseline<br/>CIS Benchmark · DISA STIG · NIST 800-53]
  B --> C[Apply controls<br/>disable services · least privilege · encryption · logging]
  C --> D[Automate via IaC<br/>Ansible / Chef / Puppet]
  D --> E[Audit compliance<br/>CIS-CAT · OpenSCAP]
  E --> F{Drift or gaps?}
  F -->|Yes| C
  F -->|No| G[Hardened baseline<br/>monitored continuously]