4.1b — Device Hardening Across Categories (17)

Hardening guide

Vendor or community published document specifying exact configuration changes to secure a system beyond its insecure default state.

Default configuration risk

Out-of-the-box settings are rarely secure; hardening is the process of changing them.

Mobile device hardening

Patching, plus logical segmentation of company data from personal data on the same device.

Data segmentation (mobile)

Separating corporate and personal data on a device so a compromise of one doesn't expose the other.

Workstation hardening

Patch management (OS, application, firmware), removing unused software to shrink attack surface.

Network infrastructure hardening

Switches, routers, and firewalls run embedded, purpose-built OSes; hardening means changing default credentials, configuring authentication, applying vendor patches.

Cloud management workstation

Dedicated, highly secured device used to administer cloud infrastructure; a high-value target since it often has broad access.

Least privilege (cloud)

Configuring cloud services, accounts, and applications with only the minimum access needed to function.

EDR (Endpoint Detection and Response)

Security tooling monitoring endpoints, including cloud instances, for attacks and confirming malware protection is current.

Server hardening

Patch and service pack management, password length and complexity, least privilege, disabling unused accounts, restricting which devices can reach the server, EDR/antivirus.

Service pack

A bundled group of updates for an OS, as opposed to individual patches.

SCADA/ICS hardening

Air-gapped isolation from the rest of the org's network, no internet access, centralized monitoring via distributed control system.

Embedded system hardening

Limited OS access makes patching hard; install rare patches promptly; segment onto their own network; add a firewall in front.

RTOS hardening

Isolate from the rest of the network so nothing interferes with deterministic timing; run minimum necessary services; use a separate firewall or host-based security if network communication is required.

IoT hardening

Prioritize patches highly since vendors aren't security specialists; segment onto a dedicated network to contain any compromise.

Hardening checklist (general pattern)

Patch/update, change defaults, remove unnecessary software/services/accounts, segment/isolate, apply least privilege, add monitoring. Applies across every device category.

Cloud backup (hardening)

Even cloud-based systems need regular backups; backing up to a separate cloud provider is a good practice.