System Hardening

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

Included in this chapter:

Activity	What you do	What it reduces
Least functionality	Uninstall unused software, disable unused services and ports	Attack surface from features that need not run
Remove default accounts	Delete or disable built-in and sample accounts	Known-target accounts an attacker can try
Change default credentials	Replace every factory password with a strong one	Easily guessed, publicly documented logins
Apply a baseline	Configure to an approved hardening standard (e.g. CIS Benchmark)	Inconsistent, ad-hoc per-machine settings
Patch management	Test and apply vendor updates on a schedule	Open, known vulnerabilities flaws fixes exist for
Configuration monitoring	Check running systems against the baseline	Configuration drift away from the secure state

Cheat sheet

System hardening shrinks the attack surface by removing what a system does not need
Least functionality: provide only the capabilities the system needs, disable the rest
Configuration management is the discipline that maintains a secure baseline over time
A baseline is the documented, approved reference configuration for a system
Adopt an established hardening benchmark instead of inventing your own
Configuration drift is divergence from the baseline, and monitoring is the fix
Changes to a hardened system flow through change control
Patch management is the organized cycle of applying vendor fixes for known flaws
Treat patching as scheduled preventive maintenance, not an emergency
The patch lifecycle is identify, test, deploy, verify
Test a patch in non-production before it touches live systems
Verify a patch took effect; deploying is not the same as fixing
Phased (ringed) deployment catches a bad patch on a few systems first
When you cannot patch, mitigate instead, never ignore the flaw
Remove or disable unnecessary services, software, and open ports
Remove or disable default and sample accounts
Change every default password before a system goes into service
Signature-based antivirus only catches malware it already has a signature for
Manage devices with encrypted protocols, not cleartext ones

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet