Mastering Cybersecurity: Day 14 of the 100-Day Challenge

Introduction To Security Hardening

Security hardening is the process of strengthening a system to reduce its vulnerability and attack surface. All the potential vulnerabilities that a threat actor could exploit are referred to as a system's attack surface.

Let's use an example that compares a network to a house. The attack surface would be all the doors and windows that a robber could use to gain access to that house. Just like putting locks on all the doors and windows in the house, security hardening involves minimizing the attack surface or potential vulnerabilities and keeping a network as secure as possible.

OS hardening

The operating system is the interface between computer hardware and the user. The OS is the first program loaded when a computer turns on. The OS acts as an intermediary between software applications and the computer hardware. It's important to secure the OS in each system because one insecure OS can lead to a whole network being compromised. There are many types of operating systems, and they all share similar security hardening practices. Some OS hardening tasks are performed at regular intervals, like updates, backups, and keeping an up-to-date list of devices and authorized users. Other tasks are performed only once as part of preliminary safety measures. One example would be configuring a device setting to fit a secure encryption standard. Let's begin with OS hardening tasks that are performed at a regular interval, such as patch installation, also known as patch updates.

Network Hardening

Network hardening focuses on network-related security hardening, like port filtering, network access privileges, and encryption over networks. Certain network hardening tasks are performed regularly, while others are performed once and then updated as needed. Some tasks that are regularly performed are firewall rules maintenance, network log analysis, patch updates, and server backups. Network log analysis is the process of examining network logs to identify events of interest. Security teams use a log analyzer tool or a security information and event management tool, also known as a SIEM, to conduct network log analysis. A SIEM tool is an application that collects and analyzes log data to monitor critical activities in an organization. It gathers security data from a network and presents that data on a single dashboard. The dashboard interface is sometimes called a single pane of glass. A SIEM helps analysts inspect, analyze, and react to security events across the network based on their priority. Reports from the SIEM provide a list of new or ongoing network vulnerabilities and list them on a scale of priority from high to low, where high priority vulnerabilities have a much shorter deadline for mitigation.

cloud Hardening

cloud network is a collection of servers or computers that store resources and data in a remote data center that can be accessed via the internet. They can host company data and applications using cloud computing to provide on-demand storage, processing power, and data analytics. Just like regular web servers, cloud servers also require proper maintenance done through various security hardening procedures. Although cloud servers are hosted by a cloud service provider, these providers cannot prevent intrusions in the cloud—especially intrusions from malicious actors, both internal and external to an organization.

One distinction between cloud network hardening and traditional network hardening is the use of a server baseline image for all server instances stored in the cloud. This allows you to compare data in the cloud servers to the baseline image to make sure there haven't been any unverified changes. An unverified change could come from an intrusion in the cloud network. Similar to OS hardening, data and applications on a cloud network are kept separate depending on their service category. For example, older applications should be kept separate from newer applications, and software that deals with internal functions should be kept separate from front-end applications seen by users.

Even though the cloud service provider has a shared responsibility with the organization using their services, there are still security measures that need to be taken by the organization to make sure their cloud network is safe. Just like traditional networks, operations in the cloud need to be secured.

Conclusion

Security hardening is essential for minimizing vulnerabilities in systems, networks, and cloud environments. Regular updates, proper configurations, and vigilant monitoring are key to reducing the attack surface. By consistently applying these practices, organizations can protect their data, ensure the integrity of their systems, and defend against cyber threats effectively.