Hardening means configuring systems so their attack surface becomes minimal: disable unnecessary services, remove default passwords and legacy protocols, restrict rights, enable logging. The gap that was never configured never needs patching.
The CIS benchmarks by the Center for Internet Security are the de facto standard for this: consensus-based, freely available hardening specifications for over a hundred technologies — from Windows and Linux via network devices to cloud platforms and Kubernetes, each with concrete settings and audit steps.
What hardening concretely comprises
Typical measures: reduce services and roles to the necessary, enforce secure authentication (MFA, no default accounts), enable encryption, switch off legacy protocols such as SMBv1 or TLS 1.0, configure local firewalls and execution controls, turn on audit logging. For network devices additionally: management access in dedicated networks, replace SNMP defaults, config backups.
CIS benchmarks structure this in two tiers: level 1 as baseline security with minimal operational impact, level 2 for elevated protection needs with stricter restrictions. Tools such as CIS-CAT or common compliance scanners check systems against the benchmarks automatically and measure the degree of fulfilment.
Running hardening sustainably
- Baselines as code: hardened images and configuration profiles instead of manual work per system.
- Drift detection: report and revert deviations from the baseline automatically.
- Document exceptions — every deviation needs reason, compensation and expiry date.
- Benchmarks also cover cloud & network: Azure/AWS/M365, switches, firewalls.