What is hardening?
Hardening is the work of configuring a system so it exposes as little as possible to an attacker. Operating systems, network devices and cloud services ship set up for convenience: extra services run, default accounts exist, management interfaces listen on every network and logging is minimal. Each default that the system's role does not need is attack surface. Hardening removes those extras and locks down what remains.
The target state is written down as a secure baseline: an approved list of settings for a particular platform, for example every Windows 11 laptop, every Linux web server or every access switch of one model. Builds start from the baseline, and audits measure live systems against it, since ad hoc fixes and troubleshooting slowly pull systems away from it, a problem called configuration drift.
Where secure baselines come from
Most organizations adapt a published guide rather than inventing their own. Common sources are:
- CIS Benchmarks, published by the Center for Internet Security and developed by community consensus, covering operating systems, browsers, databases, network gear and cloud platforms. Level 1 profiles are meant to be safe for almost any system, while Level 2 profiles tighten further for high-security use and may break some features.
- DISA STIGs (Security Technical Implementation Guides), mandatory on U.S. Department of Defense networks and common among the contractors that support them.
- Vendor baselines, such as Microsoft's security baselines, which can be imported as Group Policy Objects.
Whatever the source, each setting the organization chooses not to apply needs a written reason. Leaving off a setting because it breaks a business application is a risk acceptance decision and should be recorded as one.
Core hardening steps
- Uninstall or disable services, roles and packages the system does not need.
- Change default passwords and disable or rename default accounts before the device reaches the network.
- Close unused ports and retire cleartext management: move from Telnet (TCP 23) to SSH, from HTTP admin pages to HTTPS, and from SNMPv1 or v2c community strings to SNMPv3.
- Patch the operating system, firmware and applications on a defined schedule.
- Apply least privilege: separate admin and daily-use accounts, unique local administrator passwords and service accounts with only the rights they need.
- Enable a default-deny host firewall, full-disk encryption and logging forwarded to a central collector.
Prefer the option that leaves the least behind: uninstalling beats switching off, and switching off beats hiding a service behind a firewall rule. A blocked service is still installed and still vulnerable, and a single mistaken rule change can expose it again.
Example: hardening Windows and Linux servers
On Windows domain members, Group Policy delivers the baseline to every computer in an organizational unit. A typical server GPO disables SMBv1, turns off LLMNR so attackers cannot collect NTLM hashes by answering failed name lookups, controls who belongs to the local Administrators group and sets the audit policy. On the server, gpresult /r confirms which GPOs actually applied.
On a new Linux database server, sudo ss -tulpn shows the Avahi mDNS service listening on UDP 5353. A database server has no use for it, so the admin runs sudo systemctl disable --now avahi-daemon.socket avahi-daemon.service and then removes the package. SELinux stays in enforcing mode, so the database process is confined by policy even if it is compromised. When SELinux blocks something legitimate, the fix is to correct the file label or set the right boolean, not to run setenforce 0.
Hardening vs. patching vs. segmentation
Patching fixes known flaws in code the system needs. Hardening changes configuration so less code is exposed and what runs has fewer privileges. A fully patched server can still be poorly hardened, for example with a default admin password, and a hardened server still needs patches. Both belong in the baseline.
Some systems cannot be hardened enough. Many IoT devices, medical devices and industrial controllers cannot run an agent or take regular firmware updates. The compensating control is segmentation: place the device on its own network segment and allow only the traffic it needs.
Hardening on the CompTIA Security+ exam
Hardening sits under SY0-801 objective 4.1, which covers applying mitigating controls in a scenario, including secure baselines and operating system controls such as Group Policy and SELinux. Wording such as reduce the attack surface, unnecessary services, default configuration or build every server the same way points to hardening or a secure baseline, and servers no longer match the approved settings points to enforcing and monitoring the baseline.
Watch for three distractors. A firewall rule that blocks an unneeded service is weaker than removing the service. Disabling SELinux, or switching it to permissive, to make an application work is the wrong fix. And for a device that cannot be patched or run security software, the usual answer is segmentation.