What is Hardening?
Hardening and security baselines (CIS Benchmarks), told as a story about a new room that arrives with everything open, and the list you lock it up by.
A new room arrives with everything open.Unused windows stand open, tools arrive switched on, and a factory password is stuck to the door. The maker ships it that way to be "easy to use."
Use it as it came, and the thieves already know it.Every new room in the world arrives the same, so thieves memorize the factory password and where the open windows are. No need to try a thousand keys.
Hardening is locking up a new room, by the list, before you use it.Board up what isn't used, change the password, switch off spare tools, turn the logbook on, put the newest planks on. What's left is the one door you actually use.
The sages' list becomes our castle's list.What to lock in each kind of room, sages from many castles have already written down. Tweak it a little for our castle and apply it to every room the same way — that's the baseline. Written into the rule scroll.
Locking up once isn't the end. Keep checking it's still the same.Copy the locked-up model room exactly, and you never start from scratch. Someone can still open a window again, so a room that drifted rings the bell. Counted from outside, the doors should be fewer too — counting our castle's doors.
Hardening = lock up the new room that arrived wide open, before you use it, by the list — board up spare doors, change the password, switch off tools, turn the logbook on. A baseline = every room by the same list, checked again and again.
Stripping a server, OS, app, or network device of unneeded services, ports, and accounts, changing default passwords, and enabling logging and patching to shrink the attack surface. A public standard like the CIS Benchmarks, tuned to the organization, becomes the security baseline — cloned as a golden image and watched for configuration drift.
When grown-ups say it
- Hardening
- Locking up before use. Clearing a new room of unused doors, tools, and the factory password. What remains is the one door you actually use.
- Security baseline
- Every room by the same list. Our castle's lock-up list. Every new room goes through it. → the castle's rule scroll
- CIS Benchmarks
- The sages' list. A public list written by many castles together — what to lock in each kind of room, why, and how to check.
- Attack surface
- How many doors a thief could try. Hardening is about making this number smaller. → counting our castle's doors from outside
- Insecure defaults
- The room that arrived open. Things left open for convenience. The factory password is the classic. → the password you whisper to the doorkeeper
- Unnecessary services
- Tools that arrived switched on. If it's on but unused, it's a way in. Switch it off or remove it.
- Configuration drift
- The window that opened again. A locked-up room slowly drifting away from the list. When it drifts, the bell. → checking the rented warehouse
- Golden image
- The model room. A locked-up room, copied exactly. → crates stamped out identically