Security Operations · Topic 1 of 13
Secure Baselines and Hardening Targets
Security+ secure baselines and hardening: the establish, deploy and maintain cycle, drift, and hardening for servers, network gear, cloud and IoT.
- 4 min
- A secure baseline is an approved configuration. The steps are establish, deploy and maintain.
- Configuration drift is the slow change away from the baseline, and it must be detected and corrected.
- Hardening removes unneeded software, services and ports, and changes default credentials.
What it is
A secure baseline is an agreed, documented configuration that a type of system must meet. Hardening is the work of bringing a system to that state by removing weaknesses.
Without a baseline, every server and laptop drifts into a different state, and nobody can tell whether a system is safe. A baseline gives a standard to build to and to check against.
How it works
The baseline cycle
The objective names three steps.
| Step | Meaning |
|---|---|
| Establish | Define the approved settings, often starting from a vendor guide or an industry benchmark |
| Deploy | Apply the settings through images, scripts or policy tools |
| Maintain | Check regularly, fix drift and update the baseline when requirements change |
Drift happens when settings change over time, either by accident or by someone with access. Automated configuration tools can report drift and reset it.
Common hardening actions
| Action | Why |
|---|---|
| Remove unneeded software and services | Fewer flaws to attack |
| Close unused ports and disable unneeded protocols | Fewer entry points |
| Change default accounts and passwords | Defaults are public knowledge |
| Apply patches and firmware updates | Fix known flaws |
| Enable logging | Provide evidence and detection |
| Turn on host firewall and endpoint protection | Add local defense |
| Encrypt storage | Protect data if a device is lost |
Hardening targets
The objective lists the kinds of systems that need hardening.
| Target | Typical focus |
|---|---|
| Mobile devices | Screen lock, encryption, managed apps, remote wipe |
| Workstations | Patching, endpoint protection, least privilege, disk encryption |
| Switches | Disable unused ports, secure management access, port security |
| Routers | Secure management protocols, strong authentication, filter traffic |
| Cloud infrastructure | Identity policies, storage permissions, logging, network rules |
| Servers | Remove unneeded roles, restrict administrative access, patch |
| Industrial control systems (ICS) and supervisory control and data acquisition (SCADA) | Isolation, strict access, careful change control |
| Embedded systems and real time operating systems (RTOS) | Disable debug features, restrict physical and network access |
| IoT devices | Change default credentials, update firmware, isolate on a separate network |
In each case the idea is the same: allow only what is required and make it hard to change without authorization.
Management access
Administrative interfaces should use secure protocols such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS), not Telnet or plain HTTP. They should be reachable only from a management network or a jump server, and they should require strong authentication.
Using benchmarks
Industry benchmarks, such as those from the Center for Internet Security (CIS), give detailed recommended settings per product. They are a good starting point for a baseline, and the baseline is then adjusted for the organization's needs.
What to remember for the exam
- A secure baseline is an approved configuration. The steps are establish, deploy and maintain.
- Configuration drift is the slow change away from the baseline, and it must be detected and corrected.
- Hardening removes unneeded software, services and ports, and changes default credentials.
- Targets include mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded systems, RTOS and IoT.
- Management interfaces should use encrypted protocols and limited access paths.
- Benchmarks provide a starting point for baselines.
- Logging should be enabled, since evidence is needed after an incident.
- Hardening is continuous, not a one time task.
A question about "reducing the attack surface of a new server" is usually answered by disabling unused services, closing unneeded ports and applying patches.
Common mistakes
Treating the baseline as a one time project. Systems drift, so the baseline needs monitoring and reviewing.
Leaving default accounts in place. Default usernames and passwords are in public lists.
Using Telnet or HTTP to manage devices. These send credentials in clear text.
Hardening servers but forgetting network devices and IoT. Switches, routers and cameras are also targets.
Copying a benchmark without testing. A strict setting may break a business application, so test before wide deployment.
Do not disable a service until you know what depends on it. Use change management and a backout plan, even for hardening.
Check yourself
What are the three steps of the secure baseline cycle?
Establish, deploy and maintain.
What is configuration drift?
The gradual change of a system's settings away from the approved baseline.
Why should switches and routers be managed with SSH instead of Telnet?
SSH encrypts the session and credentials, while Telnet sends them in clear text.
Topic 1 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.