OS Hardening: Patching, Baseline Config, and CIS Benchmarks

OS hardening is the process of reducing an operating system's attack surface by removing unnecessary features, applying security configurations, and keeping the system patched. A freshly installed operating system is not secure by default — it prioritizes usability, enabling services and features that many users might want but that most enterprise servers do not need. Every enabled service, open port, and default credential is a potential entry point for attackers. Hardening systematically closes these entry points before a system enters production.

Patch management is the process of identifying, testing, and applying software updates that fix security vulnerabilities. An unpatched system is one of the most exploitable targets — many major breaches (Equifax 2017, WannaCry 2017) exploited known, already-patched vulnerabilities that organizations simply had not applied. A mature patch management process defines: patch identification (subscribe to vendor advisories, CVE feeds), criticality classification (Emergency/Critical/High/Medium), testing timelines (critical patches within 48-72 hours in many frameworks), and deployment verification.

Every running service is a potential attack vector. OS hardening starts with a service audit: list all running services, identify their purpose, and disable any that are not required for the system's role. On Windows Server, roles like Print Spooler, Remote Registry, and LLMNR are frequently disabled on servers that do not need them. On Linux, services like rpcbind, cups (printing), and avahi (mDNS) are typical candidates. The principle is: if you do not need it, disable it.

Installed software that is not used represents unnecessary risk. Every package introduces potential vulnerabilities — even well-maintained software has CVEs. OS hardening includes: removing language runtimes not required by applications (Python, Perl, Ruby on web servers), removing development tools (compilers, debuggers on production systems), and removing default application packages that ship with OS images (FTP servers, telnet clients, SNMP agents). Container images should use minimal base images (Alpine, scratch, distroless) for the same reason.

Default accounts with known usernames and passwords are among the first things attackers try. Hardening steps: disable the built-in Administrator account (Windows) and rename it if disabled is not possible; rename the root account or restrict root SSH login (Linux); change all default passwords on appliances, databases, and applications before they reach production; remove guest accounts; and disable service accounts that do not require interactive login. A scan tool like Nessus will flag default credentials as critical findings.

Secure file system permissions enforce least privilege on the OS. Web server processes should not have write access to the directories they serve. Application accounts should not have read access to configuration files containing credentials. On Linux, setuid and setgid binaries should be audited because they run with elevated privileges regardless of who executes them. On Windows, NTFS permissions and DACL auditing ensure that sensitive directories (SAM hive, shadow copies, credential stores) are accessible only to authorized processes.

CIS Benchmarks are free, community-developed hardening guides for specific operating systems, applications, and cloud platforms. Each benchmark contains hundreds of specific configuration recommendations with rationale, remediation steps, and audit commands. CIS Benchmarks use two profile levels: Level 1 — basic, broadly applicable configurations that do not restrict functionality; Level 2 — advanced configurations for high-security environments that may impact usability. Benchmarks exist for Windows Server, Ubuntu/RHEL, macOS, Docker, Kubernetes, AWS, Azure, GCP, browsers, and databases.

A security baseline is a documented set of configuration settings that every system in a role category must meet. Baselines are applied via Group Policy Objects (GPOs) on Windows, Ansible playbooks, Chef cookbooks, or Puppet manifests on Linux. Configuration management tools enable drift detection: if a system deviates from the approved baseline (e.g., a service is re-enabled), automated alerts and auto-remediation can bring it back into compliance. NIST SP 800-128 provides guidance on security-focused configuration management for federal systems.

Hardening is not just about prevention — logging and monitoring are equally important. Configure audit policies to capture: authentication events (success and failure), privilege escalation, object access (sensitive file reads), process creation (with command-line arguments), and network connection events. Logs must be forwarded to a centralized SIEM in near-real time so that local attackers with admin rights cannot cover tracks by clearing event logs. Retain logs for at least 12 months per most compliance frameworks.

Manual verification of hardening benchmarks on every system is impractical at scale. Compliance scanning tools automate this check. OpenSCAP (open source) applies SCAP content to Linux systems and generates HTML reports showing passed, failed, and not-applicable checks. Nessus includes CIS benchmark policies. Microsoft Security Compliance Toolkit evaluates Windows systems against Microsoft baselines. These tools are run on a regular schedule (weekly or monthly) and deviations trigger remediation tickets in the change management system.

On Windows domains, Group Policy Objects (GPOs) are the primary mechanism for applying and enforcing security baselines at scale. Security templates (pre-built or custom .inf files) can be imported into GPOs to configure hundreds of settings simultaneously: account policy, audit policy, user rights assignment, security options, and registry values. The Security Configuration and Analysis snap-in and secedit command-line tool compare current settings against a defined template and generate compliance reports. GPOs apply at startup and at regular intervals, ensuring drift from baseline is automatically corrected.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: OS hardening reduces attack surface by disabling services, removing software, securing accounts, and applying least-privilege permissions, patch management closes known vulnerabilities with criticality-based SLAs, and CIS Benchmarks provide Level 1 (basic) and Level 2 (advanced) configuration guidance enforced through automated compliance scanning tools. Next up we explore Mobile Device Management and BYOD policies.