How hardening works and how it is integrated into information security processes

Ruslan Rakhmetov, Security Vision

With the growing number of cyber attacks and stricter requirements for data protection, hardening is becoming an integral part of the cybersecurity strategy for both large companies and small businesses. In this article, we want to analyze what hardening is, why it is needed and how to integrate it into information security management processes. When discussing cyber defense and cyber incidents, we talked a lot about software updates and vulnerability management, but hardening is understood as the process of enhancing the security of computer systems, servers, operating systems, networks and applications by not only eliminating potential vulnerabilities and reducing the attack surface .

An attack surface is the sum of all the ways an attacker can penetrate a system. The fewer these ways, the more secure it is. Hardening helps minimize the number of open ports, disable unnecessary services, tighten access rights, and ensure that software is up to date.

Hardening can be used in everyday life, to protect personal computers and systems, we will analyze the basic principles of this process, but first we will talk about how it can be useful for companies of different sizes:

Small businesses (shops, studios, individual entrepreneurs and other companies with a small number of employees and systems) may face threats such as viruses and ransomware, customer base leaks, website and online store hacking, loss of access to accounting. To remove unnecessary vulnerabilities from a website (for example, hide the admin panel, disable FTP), protect it from being taken over for mining or spam, restrict access to the customer base (only for the owner and accountant) and generally minimize damage during a virus attack (for example, a ransomware has entered the system, but cannot get into the cloud or cash register), companies of this size can:

• Set up two-factor authentication;
• Remove unnecessary CMS plugins;
• Update your router and change the default password.

Medium-sized businesses (companies with an IT department, internal network, cloud) usually face other threats, such as internal leaks (for example, an employee leaves with a customer base), threats through partners and contractors, attacks on the site or API, and vulnerabilities in the DevOps infrastructure if it is engaged in its own development. In order to limit employee access only to the necessary resources, segment the network (for example, so that the accounting department does not have access to all data in the CRM, regularly scan servers for vulnerabilities and implement updates, and centrally control logins and actions (audit) - you can implement:

• Setting up password policy and key rotation;
• WAF for web application protection;
• Zero- gate isolation of containers and services trust;

Large businesses and corporations are more likely to become victims of targeted APT attacks, supply chain compromise, and malware penetration into the infrastructure. Therefore, to ensure compliance with international standards (ISO 27001, PCI DSS, NIST) and automate updates and protection across the entire organization (to make the infrastructure segmented and fault-tolerant), such companies:

• Implement SIEM and SOAR systems for monitoring and response;
• Apply custom policies in Active Directory and AzureAD ;
• Red / Blue is being held team training and external security audit.

Thus, to protect small and medium businesses, vendors develop easy-to-install and easy-to-use tools (like VS Basic for comprehensive vulnerability management), and large companies that require multiple integrations in the operation of their processes are offered automation and orchestration solutions (for example, the SOT direction) Security product line Vision), including SIEM , XDR , SOAR , TIP and other products along with Security class solutions Profile Compliance ( SPC ) for hardening management.

SPC solutions, are:

• Minimization of components and services — installing only the necessary programs and removing everything unnecessary. As if you left only those appliances in the kitchen that you use every day, and put everything else in the cupboard, turned off unnecessary notifications on your phone so that they do not distract and do not overload the system, or donated old unwanted clothes to charity, recycling or to a store to receive a discount on a new purchase, and also to quickly find the necessary wardrobe items.
• Restricting access rights is the application of the principle of least privilege, as if you were disabling a child's ability to install software, or allowing a guest to use Wi-Fi but not access your printer (e.g., via a router's network on a second frequency). This makes sense if you think of these access rights as keys to a house: you only give them to family members, not all the neighbors.
• Regular update - installation of current patches and updates. It works like vaccinations, which in order not to get sick you need to do on time and regularly, like pumping up tires and changing the oil in a car - keeping systems up to date and with bugs and "glitches" closed.
• Encryption is the protection of data at rest and in transit. It's like sending a letter in a closed envelope instead of on a postcard, or storing your money not in a "bank" under your mattress, but in a bank or safe with a code. You can provide website encryption, for example, by using HTTPS instead of HTTP.
• Service isolation - each service should work in isolation, if possible - in a container or virtual machine. If you imagine a large closet or pantry, the isolation principle could be described as storing household chemicals separately from food, and if you consider working in a browser, viewing content on a smart TV or organizing a library on a game console - using different profiles for different people.
• Monitoring and auditing — logging events, detecting suspicious activity. This principle works like video surveillance in the entrance (you can see who came in and when), checking the browser history (to find out who did what, or, on the contrary, delete the history of recent activities) or like water and electricity meters — you can track surges and understand where the leak is.

For example, it can be applied to operating systems Linux and Windows: remove unnecessary packages (e.g. FTP, Telnet ), configure firewall (UFW, firewalld , iptables ), restrict SSH access (disable root access, MFA ), access control ( SELinux or AppArmor ), disable SMBv1, remove obsolete services, apply group security policies, use BitLocker to encrypt drives and update via WSUS or Intune .

Hardening Network security is achieved by limiting open ports and services (for example, blocking Telnet , SNMPv1), using VPN and network segmentation, implementing IPS/IDS systems, forced traffic encryption (TLS, IPsec ), HSTS for web applications.

Hardening databases and applications are carried out by deleting default users and passwords, restricting IP access to the DBMS, setting up log rotation and encryption of stored data, using WAF and updating engines and dependencies ( npm , pip , composer , etc.).

Combining the six principles, hardening helps reduce the attack surface , which we mentioned at the very beginning of the review, and with the use of automation platforms, this process can be significantly accelerated and further reduce the likelihood of missing something important or making a mistake. Additionally, this tool is often associated with processes and technologies for finding and eliminating vulnerabilities to reduce the number of vulnerable spots, complicating entry for an intruder. And even in monitoring mode, it allows for early detection and localization of problems and increases overall control over the system.

Hardening works as a preventative measure: it reduces the likelihood of a successful attack by eliminating weaknesses before an attacker can exploit them. This is not a one-time action, but an ongoing process that requires a systematic approach and regular audits. Its task is not only to eliminate current vulnerabilities, but also to create an architecture in which attacks are unlikely or ineffective. In the age of digital threats, neglecting hardening means putting at risk not only data, but also the reputation of the business.