OS hardening

3.5 Given a scenario, apply server hardening methods.

📘CompTIA Server+ (SK0-005) 

---

1. Disable Unused Services

What it means

Operating systems and servers often come with many services running by default. A service is a background process that provides a function (for example: web service, file sharing, printing).

Why it is important

Every running service is a potential entry point for attackers. If a service is not needed, it should be turned off to reduce risk.

Example in IT environment

• A server is used only for a database.
• Web server services (like HTTP/HTTPS) are not needed.
• Disabling web services prevents attackers from exploiting web-related vulnerabilities.

Exam point

• Reduce attack surface
• Only enable services that are required for business functions

---

2. Close Unneeded Ports

What it means

A port is a communication endpoint used by services (for example: port 80 for HTTP, port 22 for SSH).

Why it is important

Open ports allow network communication. If unnecessary ports are open, attackers can scan and exploit them.

Example in IT environment

• A server only needs SSH (port 22) for remote administration.
• Other ports like FTP (port 21) or Telnet (port 23) are closed if not used.

Exam point

• Use tools like netstat or ss to check open ports
• Close ports using firewall rules or service configuration
• Only allow required ports

---

3. Install Only Required Software

What it means

Only install software that is necessary for the server’s function.

Why it is important

Extra software increases:

• Vulnerabilities
• Maintenance overhead
• Attack surface

Example in IT environment

• A database server should only have database software installed.
• Do not install unnecessary applications like media players or unused utilities.

Exam point

• Follow the principle of least functionality
• Remove unused applications and packages

---

4. Apply Driver Updates

What it means

Drivers are software components that allow the OS to communicate with hardware (like network cards, storage devices).

Why it is important

Outdated drivers can have security vulnerabilities that attackers may exploit.

Example in IT environment

• A network card driver has a known security flaw.
• Updating the driver fixes the vulnerability and prevents exploitation.

Exam point

• Keep hardware drivers updated
• Use vendor-provided drivers from trusted sources

---

5. Apply OS Updates (Patch Management)

What it means

OS updates (patches) fix bugs, improve performance, and most importantly, fix security vulnerabilities.

Why it is important

Unpatched systems are one of the most common attack targets.

Example in IT environment

• A security vulnerability is discovered in the OS kernel.
• The vendor releases a patch to fix it.
• Installing the patch prevents attackers from exploiting that vulnerability.

Exam point

• Regular patching is essential
• Use:
  • Automatic updates (with control)
  • Patch management systems
• Test patches before deploying in production (important for servers)

---

6. Firewall Configuration

What it means

A firewall controls incoming and outgoing network traffic based on predefined security rules.

Why it is important

It acts as a barrier between trusted and untrusted networks.

Example in IT environment

• Allow:
  • HTTP (port 80)
  • HTTPS (port 443)
  • SSH (port 22)
• Block all other incoming traffic by default.

Types of firewall rules:

• Inbound rules – control traffic coming into the server
• Outbound rules – control traffic leaving the server

Exam point

• Use default deny (block everything) and allow only required traffic
• Configure firewall rules based on:
  • IP addresses
  • Ports
  • Protocols
• Examples of firewall tools:
  • Windows Defender Firewall
  • iptables / firewalld (Linux)

---

Key Principles of OS Hardening (Important for Exam)

1. Principle of Least Privilege (PoLP)
   Users and services should have only the minimum permissions needed.
2. Minimize Attack Surface
   • Disable unnecessary services
   • Close unused ports
   • Remove unused software
3. Defense in Depth
   Use multiple layers of security:
   • OS hardening
   • Firewall
   • Access controls
   • Monitoring
4. Regular Maintenance
   • Apply patches
   • Update drivers
   • Review configurations

---

Summary (Exam Quick Points)

• Disable unused services to reduce vulnerabilities
• Close unnecessary ports to block unwanted access
• Install only required software to minimize attack surface
• Keep drivers updated to fix hardware-related security issues
• Apply OS updates regularly to patch security flaws
• Configure firewall to allow only necessary traffic