System hardening in plain English
New servers, laptops, routers, or cloud services often come configured out of the box to be as easy to use as possible. Convenience takes priority over security: many services run “just in case,” legacy protocols stay enabled for compatibility reasons, and some devices have default passwords. Hardening reverses these priorities.
Picture an office building after hours. The building manager locks all the side entrances nobody needs in the evening, shuts down the freight elevator, and leaves only one monitored main entrance open. The rooms stay the same – but there are far fewer ways in.
In technical terms, hardening reduces the attack surface – the sum of all the points where an attacker could gain a foothold.
How system hardening works
- Inventory: Which systems are there, and what tasks do they perform?
- Define requirements: For each type of system, a binding security configuration is defined, often called a hardening guideline or baseline. Guidance comes from sources such as the CIS Benchmarks (freely available configuration recommendations for many systems), vendor recommendations, and the modules of IT-Grundschutz, the baseline security methodology of the BSI (Germany’s Federal Office for Information Security).
- Implement: The settings are rolled out as automatically as possible, for example via Group Policy (central settings in Windows networks) or configuration management tools. That way, new systems are also hardened from the start.
- Review and maintain: Over time, configurations gradually drift away from the baseline, for example due to updates or quick changes in day-to-day operations. Regular checks bring them back in line.
Typical hardening measures include:
- disabling services, ports, and features that aren’t needed
- changing default passwords and disabling guest accounts
- turning off outdated protocols such as SMBv1 (for file sharing) or Telnet (for remote access), and protecting connections against eavesdropping and tampering through encryption and signing
- restricting permissions to the bare minimum
- securing administrative access and keeping it unreachable from the internet
- blocking macros (small programs in Office documents) when the file comes from the internet
- enabling logging so that attacks can be detected
By the way, hardening is not the same as patch management. Updates fix programming errors; hardening eliminates risky settings. The two complement each other.
A practical example
Here’s a typical scenario: A car dealership with several locations has its internet-facing systems tested. All updates have been installed. Even so, the testing team finds several points of attack: the firewall’s administration interface can be reached from the internet. One server is still running a file transfer service from the setup phase that transmits passwords unencrypted. And the web server reveals its exact software version in every response.
None of these issues is a programming error – they are default settings and leftovers. The company restricts administration to the internal network, switches off the old service, and hides the version information. It also defines a hardening guideline for new servers. In the retest, the points of attack are gone.
Why does this matter for businesses?
Many successful attacks don’t need a sophisticated exploit – a specialized tool that targets a programming error. Instead, they take advantage of misconfigurations and default settings. In the OWASP Top 10:2025, the best-known overview of the most critical risks for web applications, the category “Security Misconfiguration” ranks second.
Hardening also works preventively against unknown vulnerabilities: a disabled feature can’t be attacked, even if a new vulnerability in it becomes known tomorrow. What’s more, many measures cost only working time, not new technology.
Regulations and standards also call for secure configurations. The GDPR requires appropriate safeguards that take the state of the art into account. Annex A of ISO/IEC 27001:2022 contains a dedicated control for configuration management. And IT-Grundschutz describes hardening requirements for many types of systems.
How to protect your organization
- Define guidelines: Set hardening requirements for servers, clients, network devices, and cloud services based on recognized recommendations.
- Start hardened: Only put new systems into operation once they are hardened, ideally from vetted templates.
- Implement centrally: Roll out settings automatically so that no system gets forgotten.
- Manage exceptions deliberately: If an application needs a legacy protocol, assess the risk, add extra safeguards, and document the exception.
- Check regularly: Configuration and vulnerability scans reveal deviations across the board; penetration tests show the actual effect.
- Stay on it: Check again after updates and changes – hardening is an ongoing task.
How Rootsektor can help
In a penetration test for Network & Infrastructure, we check whether your hardening holds up in practice. We look for insecure protocols, weak default settings, and unnecessary services and show which attack paths result from them. We carry out internal tests either on site or remotely, as you prefer. You receive prioritized, concrete hardening recommendations; once they have been implemented, we verify their effectiveness in a free retest. You can get a fixed-price quote after scoping via our Pentest Quote page.