System hardening means identifying weaknesses in your systems and closing them off before an attacker can exploit them. The goal is to reduce the attack surface and make every system in your environment more resilient.

[System] --> [Identify Weaknesses] --> [Close Gaps] --> [Hardened System]

1. Endpoints

An endpoint is any point where a user or service interacts with data.

[Workstation] <--> [Network] <--> [Server]
     ^                                ^
     |                                |
  Endpoint                        Endpoint

Both sides must be secured:

• Servers — where data is stored and processed
• Workstations — where users access and interact with data

Endpoints are the most common targets because they are the most exposed.

2. Baseline Security Configurations

A security baseline is a minimum standard configuration applied to all systems.

Sources:

• Industry best practices (CIS Benchmarks, NIST guidelines)
• Vendor hardening guides
• Internal security policies

What a baseline covers:

+ Disable unused services and ports
+ Enforce strong password policies
+ Apply least privilege to accounts
+ Enable logging and auditing
+ Remove default credentials

Baselines ensure consistency. Every system starts from a known secure state.

3. Patch Management

Patches fix known vulnerabilities. Not patching is one of the most common causes of breaches.

Best practices:

[Vendor releases patch]
          |
          v
[Review patch notes]
          |
          v
[Test in staging environment]
          |
          v
[Deploy to production]
          |
          v
[Document the change]

Stay current with:

• OS updates
• Application patches
• Firmware updates
• Security advisories

4. Backups

Regular backups protect against data loss from attacks, failures, or accidental changes.

Backup considerations:

• Frequency — how often backups run
• Retention — how long backups are kept
• Storage location — on-site, off-site, cloud
• Test restores — verify backups can actually be restored

No backup --> Ransomware hits --> Data gone
Backup exists --> Ransomware hits --> Restore and recover

5. Antivirus

Antivirus software detects and removes malware from endpoints.

How it works:

[File / Process]
       |
       v
[Compare against known malware signatures]
       |
       +--> Match found --> Quarantine / Remove
       +--> No match --> Allow

Limitations:

• Signature-based detection only catches known malware
• New or modified malware can evade it
• Must be kept updated to remain effective

Antivirus is a baseline control, not a complete solution on its own.

6. Endpoint Detection and Response (EDR)

EDR goes beyond antivirus by monitoring endpoint behavior in real time.

Antivirus  --> Detects known signatures
EDR        --> Detects suspicious behavior, even from unknown threats

Capabilities:

• Continuous monitoring of endpoint activity
• Detection of unusual process behavior
• Automated response actions (isolate, terminate, alert)
• Forensic data collection for investigation

EDR is a more advanced layer of endpoint protection compared to traditional antivirus.

7. Data Loss Prevention (DLP)

DLP software monitors and controls how sensitive data moves across systems and networks.

Use case:

Internal project: "Project Hummingbird"
      |
      v
DLP monitors all communications for the keyword
      |
      +--> Flagged: "Hey, Project Hummingbird is launching next month" (chat)
      +--> Flagged: "Have you seen the hummingbirds outside?" (false positive)
      |
      v
Security team reviews flagged events in context

What DLP monitors:

• Email
• Chat messages
• File transfers
• Clipboard activity
• USB and removable media

DLP does not automatically block everything. It flags events for human review, giving the security team context to decide what action to take.

8. Full Disk Encryption (FDE)

Full disk encryption protects data on a drive if the device is lost or stolen.

How it works:

OS writes data
      |
      v
Encryption software intercepts (e.g., BitLocker)
      |
      v
Data encrypted using key (often stored in TPM)
      |
      v
Encrypted data written to drive

OS reads data
      |
      v
Encrypted data pulled from drive
      |
      v
Decryption software decrypts using key
      |
      v
Plaintext data handed to OS

Key detail:

• Software solution — runs on a standard hard drive
• Uses tools like BitLocker (Windows)
• Key often stored in the Trusted Platform Module (TPM)

Drawback:

Performance hit

Because encryption and decryption happen in software, there is added CPU overhead. The system runs slightly slower.

9. Self-Encrypting Drives (SED)

A self-encrypting drive handles encryption entirely in hardware, inside the drive itself.

OS writes data
      |
      v
Drive hardware encrypts automatically
      |
      v
Data stored encrypted

OS reads data
      |
      v
Drive hardware decrypts automatically
      |
      v
Plaintext data sent to OS

Key differences from FDE:

Security property:

If someone physically removes an SED from a system, the drive will not decrypt without contact with the original TPM. The data is unreadable on any other machine.

10. File Integrity Monitoring (FIM)

File integrity monitoring detects unauthorized changes to files on a system.

How it works:

[Authorized baseline]
        |
        v
Hash digest generated for each file
        |
        v
Hashes stored securely

Later...

[File on system]
        |
        v
FIM recalculates hash
        |
        +--> Hash matches --> No change, all good
        +--> Hash differs  --> ALERT: File tampered

What FIM detects:

• Unauthorized file modifications
• Unexpected configuration changes
• Malware dropping or replacing files

FIM does not tell you who made the change. It tells you that a change occurred, so your team can investigate.

Key concept: integrity = hashing. Whenever you see file integrity monitoring, think hashing.

11. Network Device Hardening

Securing network infrastructure is part of endpoint hardening.

Devices:

• Routers
• Firewalls
• Switches
• Wireless access points

Hardening steps:

+ Use encrypted protocols (SSH instead of Telnet, HTTPS instead of HTTP)
+ Apply access control lists (ACLs) to filter traffic
+ Disable unused ports and services
+ Change default credentials
+ Keep firmware updated
+ Log and monitor all access

Firewalls and ACLs control what traffic can flow where:

[External Traffic]
        |
        v
[Firewall / ACL]
        |
        +--> Allowed --> Pass through
        +--> Denied  --> Block

Without network hardening, attackers can move freely inside your network even if individual endpoints are secured.

System Hardening Summary

Baseline configs       --> Start from a known secure state
Patch management       --> Close known vulnerabilities
Backups                --> Recover from attacks or failures
Antivirus              --> Detect known malware signatures
EDR                    --> Detect behavioral threats in real time
DLP                    --> Monitor and control sensitive data flow
Full disk encryption   --> Software-based drive encryption (TPM + BitLocker)
Self-encrypting drive  --> Hardware-based drive encryption, less overhead
File integrity monitor --> Detect unauthorized file changes via hashing
Network hardening      --> Secure routers, firewalls, ACLs, protocols

Quick Reference