System Hardening
Reducing attack surface through secure configuration: disabling unnecessary services, changing default credentials, removing unnecessary software, and implementing host-based protections like firewalls and intrusion prevention.
Understanding System Hardening
System hardening reduces attack surface by removing, disabling, or securing everything not essential for a system's function. Every enabled service, open port, and installed application is a potential attack vector.
Key hardening activities: • Disable unnecessary services — Reduce running software • Change defaults — Credentials, ports, configurations • Remove unnecessary software — Fewer components to exploit • Host-based protections — Firewalls, AV, HIPS
The hardening principle: "If you don't need it, disable it. If you can't disable it, secure it."
Why This Matters for the Exam
System hardening is heavily tested on SY0-701 as a fundamental security practice. Questions cover what to harden, why it matters, and specific hardening techniques.
Understanding hardening helps with security configuration, compliance, and reducing risk. CIS Benchmarks and DISA STIGs provide standardized hardening guidance.
The exam tests both conceptual understanding and specific hardening activities for different system types.
Deep Dive
Disabling Unnecessary Services
Every service is potential attack surface.
Services to Review:
| Service Type | Examples | Risk |
|---|---|---|
| Remote access | SSH, RDP, Telnet | Remote exploitation |
| File sharing | SMB, NFS, FTP | Data exposure, exploitation |
| Web services | HTTP, HTTPS | Web attacks |
| Database | MySQL, MSSQL | Data theft |
| Print Spooler | Vulnerabilities (PrintNightmare) | |
| Discovery | SSDP, mDNS | Information leakage |
Hardening Process:
- 1.Inventory running services
- 2.Identify business need for each
- 3.Disable unnecessary services
- 4.Restrict access to necessary services
- 5.Monitor remaining services
Windows Service Hardening:
- •```
- •Disable:
- •- Remote Registry
- •- Telnet (if not needed)
- •- Simple TCP/IP Services
- •- Fax
- •- Print Spooler (if not printing)
- •- Xbox services (on servers)
- •```
Changing Default Configurations
Defaults are known to attackers and often insecure.
Default Changes Required:
| Default | Risk | Hardening |
|---|---|---|
| Credentials | admin/admin known | Change immediately |
| Ports | Known ports targeted | Change if possible |
| Banners | Reveal version info | Remove/customize |
| Sample apps | Known vulnerabilities | Remove |
| Debug modes | Information exposure | Disable |
Default Credential Risks:
- •Published in manuals
- •Searchable online
- •First thing attackers try
- •Common across products
Banner Hardening:
- •```
- •Before: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
- •After: SSH-2.0-CUSTOM (reveals nothing)
- •```
Removing Unnecessary Software
Less software = fewer vulnerabilities.
Software to Remove:
- •Unused applications
- •Bloatware/pre-installed software
- •Development tools on production
- •Old/unused versions
- •Sample applications
Why Remove:
- •Each application has potential vulnerabilities
- •Patches required for everything installed
- •Storage and memory consumed
- •Increased complexity
Host-Based Security Controls
Security implemented on individual systems.
Host-Based Firewall:
- •Filter traffic at endpoint
- •Control inbound and outbound
- •Application-specific rules
- •Defense in depth (beyond perimeter)
Windows Firewall Rules:
- •```
- •Block: All inbound (default)
- •Allow: Established connections
- •Allow: Specific services needed (RDP from admin VLAN only)
- •Block: All outbound to known bad IPs
- •```
Host-Based Intrusion Prevention (HIPS):
- •Detect and block attacks on endpoint
- •Application behavior monitoring
- •Exploit prevention
- •Complements network IPS
Endpoint Detection and Response (EDR):
- •Advanced threat detection
- •Behavioral analysis
- •Investigation capabilities
- •Automated response
Antimalware:
- •Signature-based detection
- •Heuristic analysis
- •Real-time protection
- •Regular updates essential
Hardening Guides and Standards
CIS Benchmarks:
- •Consensus-based hardening guides
- •Available for most platforms
- •Levels: Level 1 (basic), Level 2 (defense-in-depth)
- •Regular updates
DISA STIGs:
- •Security Technical Implementation Guides
- •DoD standard
- •Very detailed and strict
- •Required for government systems
Vendor Security Guides:
- •Microsoft Security Baselines
- •Cisco Security Guides
- •AWS/Azure security benchmarks
- •Platform-specific recommendations
Application Hardening Examples
| Application | Hardening Actions |
|---|---|
| Web Server | Disable directory listing, remove default pages, configure headers |
| Database | Disable remote root, encrypt connections, restrict accounts |
| SSH | Disable root login, use key auth, change port |
| Browser | Disable Java, Flash; enable security features |
How CompTIA Tests This
Example Analysis
Scenario: A security assessment of a new Windows server reveals: Print Spooler service running (no printers needed), Remote Registry enabled, IIS installed with default website, Administrator account active with default name, Windows Firewall disabled, and SMBv1 protocol enabled.
Analysis - Multiple Hardening Failures:
Issues Found:
| Issue | Risk | Remediation | |-------|------|-------------| | Print Spooler | PrintNightmare vulnerability | Disable service | | Remote Registry | Remote modification risk | Disable service | | IIS default site | Information disclosure | Remove or customize | | Default admin name | Easy target for attacks | Rename account | | Firewall disabled | No host protection | Enable and configure | | SMBv1 | EternalBlue vulnerability | Disable protocol |
Hardening Actions:
1. Services: ``` Disable: Print Spooler, Remote Registry Remove: IIS (if not needed) or remove default site ```
2. Accounts: ``` Rename: Administrator → Custom name Disable: Guest account Create: Named admin accounts for individuals ```
3. Network: ``` Enable: Windows Firewall Configure: Inbound/outbound rules Disable: SMBv1 protocol ```
4. Ongoing: ``` Apply: CIS Benchmark for Windows Server Enable: Audit logging Configure: Update automation ```
Key insight: Unhardened systems have multiple attack vectors. Systematic hardening using established benchmarks addresses all common weaknesses.
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"DCRH" - Hardening Actions
- •Disable unnecessary services
- •Change defaults (passwords, ports, configs)
- •Remove unnecessary software
- •Host-based protections (firewall, AV, HIPS)
Attack Surface Principle: "Less = More Secure" Fewer services → Fewer vulnerabilities Less software → Less patching needed
Defaults Danger: "Default = Dangerous" admin/admin = attacker/already inside
- •Hardening Standards: "CDS"
- •CIS Benchmarks (industry)
- •DISA STIGs (government)
- •Supplier/vendor guides
- •Host-Based Security Stack: "FAHHE"
- •Firewall (filter traffic)
- •Antimalware (detect malware)
- •HIPS (prevent exploits)
- •Hardened configuration
- •EDR (advanced detection)
Test Your Knowledge
Q1.A newly installed server has Print Spooler service running although no printing is needed. What hardening action should be taken?
Q2.What is the PRIMARY purpose of system hardening?
Q3.Which hardening standard is commonly used by the U.S. Department of Defense?
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on system hardening and other Objective 2.5 concepts.