L16. Endpoint & Server Hardening
Course outlineLesson 16 of 20
Every device connected to your network is a potential entry point. Hardening reduces the attack surface by removing unnecessary software, disabling unused services, and enforcing secure configurations.
Why Hardening Matters
Default operating system configurations prioritize convenience over security. Services are enabled by default, ports are open, and permissions are often overly broad. Hardening is the process of reducing these defaults to a minimum necessary state.
CIS Benchmarks
The Center for Internet Security (CIS) publishes free hardening benchmarks for operating systems, cloud services, and applications. Each benchmark has two levels: Level 1: Essential security measures with minimal usability impact. Recommended for all systems. Level 2: Defense-in-depth measures that may impact usability or performance. Recommended for high-security environments.
CIS Benchmarks are available for Windows, Linux, macOS, AWS, Azure, GCP, Docker, Kubernetes, and more.
Key Hardening Actions
- Remove unnecessary software: uninstall applications not required for the system's function
- Disable unused services: each running service is a potential attack surface (e.g., disable Telnet, FTP, SMBv1)
- Close unused ports: review listening ports with
netstatorss; firewall rules should default-deny - Apply patches: keep OS and all software current; enable automatic updates where safe
- Configure host-based firewall: block inbound connections on all ports not required for the system's role
- Enable full disk encryption: BitLocker (Windows), FileVault (macOS), LUKS (Linux) protect data if the device is stolen
Application Control
Application allowlisting only permits approved, explicitly listed executables to run. Anything not on the list is blocked. This is more effective against unknown malware than signature-based AV.Tools: AppLocker (Windows), Windows Defender Application Control (WDAC), SELinux.
Endpoint Detection and Response (EDR)
EDR provides real-time monitoring of endpoint activity: process creation, file operations, network connections, registry changes. It enables detection of behaviors that evade traditional antivirus and supports remote investigation and response.
- ✓CIS Benchmarks Level 1 = essential security with minimal usability impact; Level 2 = defense-in-depth for high-security environments
- ✓Application allowlisting (AppLocker/WDAC) only permits approved executables; more effective than blocklisting against unknown malware
- ✓Full disk encryption (BitLocker, FileVault) protects data at rest if a device is lost or stolen; does not protect a running, logged-in system
- ✓Removing unnecessary services reduces the attack surface; each running service is a potential entry point
- ✓EDR provides behavioral endpoint monitoring and response capabilities beyond traditional signature-based antivirus
1. A security engineer configures a policy that only allows executables in the approved software catalog to run on workstations, blocking everything else by default. What security control is this?
2. Which CIS Benchmark level is recommended for all systems and has minimal impact on usability?
3. A laptop with BitLocker-encrypted drives is stolen. The thief removes the hard drive and connects it to another computer. What happens to the data?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.