System Hardening: Reduce What Can Go Wrong

Hardening means configuring a system to reduce unnecessary risk.

Hardening does not mean making the computer impossible to use. It means removing unnecessary exposure, limiting privileges, keeping important components current, and making the intended security state visible.

A strong hardening decision answers:

• What risk does this setting reduce?
• What functionality does it affect?
• How will we verify the setting?
• What could break if we change it?

Build a baseline

A security baseline is an agreed starting configuration.

For a fictional classroom workstation, the baseline might include:

• supported operating-system version
• automatic security updates enabled
• individual user accounts
• no routine administrator use
• screen lock enabled
• firewall enabled
• unnecessary services disabled
• browser and applications updated
• backups configured
• approved software list

The exact baseline depends on the environment. The important idea is that security state should be defined, not guessed.

Scan versus harden

A configuration assessment tool can compare a system against a benchmark and report differences.

That is not the same as fixing the system.

Think of the workflow:

benchmark → scan → finding → review → approved change → rescan → evidence

A finding tells you that the current state differs from the selected benchmark or recommendation.

It does not automatically mean the setting should be changed without review.

CIS-CAT-style classroom exercise

The Garden State Cyber curriculum includes a CIS-CAT scan and hardening activity.

In Robotnix, use a teacher-provided or simulated configuration report. Do not run unauthorized scanners against school systems.

Example synthetic findings:

[FAIL] Screen lock timeout exceeds baseline
[PASS] Host firewall enabled
[FAIL] Guest account enabled
[PASS] Automatic security updates enabled
[REVIEW] Remote assistance service enabled

For each finding, record:

• current state
• desired state
• security reason
• possible operational impact
• approved change
• verification step

Not every service should be disabled

A common beginner approach is:

Turn everything off.

That can destroy availability.

Suppose remote assistance is required for the school's support process. Disabling it may reduce one exposure while breaking a legitimate function.

A better review asks:

• Is the service required?
• Who can access it?
• Can access be restricted?
• Is it updated?
• Is activity logged?

Hardening is risk reduction under operational constraints.

Users and privileges

One of the highest-value hardening decisions is limiting privilege.

Consider:

• student account: normal user
• teacher account: normal user with approved administrative escalation
• dedicated administrator account: used only when needed
• guest account: disabled unless required

If every daily account is an administrator, malware and mistakes gain more power.

Least privilege means giving users and software the access needed for the task, not every permission they might eventually want.

Backups are part of hardening

Backups do not prevent compromise, but they can reduce impact and improve recovery.

A useful backup plan answers:

• what is backed up
• how often
• where copies are stored
• who can modify or delete them
• how restoration is tested

A backup that has never been tested is a promise, not evidence.

Build a hardening worksheet

Use this synthetic workstation profile:

• automatic updates disabled
• firewall enabled
• one shared administrator account
• guest account enabled
• screen never locks automatically
• project files stored only on local disk
• browser is current
• unused file-sharing service enabled

Prioritize the findings.

For each one, assign:

• risk level: low / medium / high
• CIA property affected
• proposed control
• possible side effect
• verification evidence

Then choose the first three changes you would implement and explain why they come first.

Hardening is a cycle

Systems drift.

Users install software. Updates add features. Accounts change. Temporary settings become permanent.

That means hardening needs periodic review.

Use this cycle:

baseline → inspect → change → verify → monitor → review again

Evidence for Lesson 2

Submit:

• synthetic benchmark finding analysis
• hardening worksheet
• prioritized top-three changes
• one paragraph explaining why "disable everything" is not a defensible hardening strategy

Finish with:

The hardening setting I would verify instead of assume is ________ because ________.

Hardening is not about making a system look secure. It is about creating a configuration you can explain, inspect, and maintain.