In this lesson,
we're going to discuss device hardening
in relation to our endpoint devices.
Now, device hardening refers to ensuring that the device
has had any unnecessary applications,
services, or ports disabled or removed from that host.
To dive a bit deeper
into the definition of device hardening,
we can state that device hardening
is the process of making a host system
or application configuration secure
by reducing its attack surface
by running only necessary services,
installing monitoring software
to protect against malware and intrusions,
and establishing a maintenance schedule
to ensure the system is patched
and secured against software exploits.
Now, device hardening is applied to our endpoint devices,
our servers, our network infrastructure,
and our mobile devices as well.
Any device can be hardened,
and this helps to reduce our attack surface
and risk of attack.
When dealing with a host or a server,
it is really important to ensure
that the endpoint security software,
such as anti-malware, anti-virus,
spam filters, host-based firewalls
and log collection agents,
are all installed on that host as well,
to increase its security posture
and our ability to detect
when something is not as it should be.
Thankfully, manufacturers are helping us
in our quest for more secure hosts
by adding specialized hardware,
such as more secure BIOS configurations,
like UEFI, the Trusted Platform Module, or TPM;
and Hardware Security Modules, or HSM, into our devices.
As more and more networks become de-perimeterized,
it's going to become more important than ever
to ensure that even our endpoint devices
are well-protected from the dangers of the outside world,
and not just our servers.
To conduct host hardening,
system administrators will secure a host
by ensuring that all of its software
is patched and up to date
and that the device is properly configured.
They'll also work to remove unnecessary applications,
block unnecessary ports and services,
tightly control any external storage devices
connected to that host,
disable unneeded accounts on the system,
rename default accounts,
and change the device's default passwords.
Other forms of host hardening
include configuring a standardized baseline
for the operating system,
as well as putting in allow and deny list
for your applications on the system,
implementing security and group policies,
restricting the command-line interface from being used,
and restricting the use of peripheral devices.
When you conduct hardening,
you always want to balance the access requirements
and the usability of the system
against those open ports, protocols and services.
Our goal is to open the least amount of ports
and run the least amount of services
to effectively get the job done on a particular device.
So when it comes to hardening,
what kind of things should you be looking at?
Well, first, you should check any network interfaces
that provide connectivity to the local area network
or a wide area network.
Most commonly, you're going to have a network interface card
for wired networks
and a wireless network adapter for your Wi-Fi connection.
Some servers and hosts
may have additional network interface cards as well
that are reserved for a connection to a management LAN.
Consider each of these network connections
and determine if you really need them.
Any that are unneeded
should be explicitly disabled inside the operating system.
Second, you should look at the list of services
that are installed and running on your clients and servers.
Services are a form of application
that are running in the background
to provide some kind of functionality.
If you're not using a service,
it should explicitly be disabled on that system.
For example, let's say you're not running a print server
on your Linux server.
Well, you should disable the CUPS daemon
on that server then.
If you're running a Linux server
that doesn't have any Bluetooth devices,
you need to disable the Bluetooth daemon on that system too.
This is what I'm talking about
when I talk about disabling unneeded services.
Third, you should always look at the ports
that are open and in use,
especially if they're running different applications
on different service ports.
For example, let's say you're running an HTTP server
and you expect to see that on Port 80,
which is going to be open by default
if you're running a web server.
Any ports that you don't need open for this service
should be disabled.
And most servers will only need a couple of ports open
to perform their given function,
like a web server needing Port 80 and Port 443.
The rest should all be closed or blocked
using a host-based firewall to further harden your servers.
One thing to note with ports
is that not all servers are going to be configured
to use standardized ports.
Sometimes you may be running servers
on non-standard ports for a valid reason.
For example, if I have a single physical server
that's going to be running two different web servers on it,
I may have them running on Port 80 and Port 8080.
In this case, Port 80 is the standard port
for HTTP or web traffic.
But Port 8080 is considered a non-standard port,
and I'm using it because I need to have
two different web servers running at once
on this particular system.
Fourth, you should always ensure
that you're using disk encryption
to harden your endpoints too.
Many endpoints will hold data created by your applications,
as well as cache credentials.
Therefore, you want to make sure your storage
is encrypted on that device by default.
Easiest way to do this is to enable full-disk encryption
or use a self-encrypting drive
so, that way, your data at rest is always secure.
Fifth, you should review all of your accounts on the system
as part of your hardening.
If you have extra accounts that are not needed,
those should be disabled or deleted.
Remember, the rule of thumb
is that anything that is unused or unneeded
should be disabled, deleted, or blocked
to best harden your systems.
Now, one final word on device hardening.
It is really important
to consider the lifecycle of your device
as part of your hardening actions.
When you're buying a particular piece of software,
hardware, or operating system,
you need to consider the end of life, or EOL, date
and the end of support, or EOS, date for those items.
The end of life date usually refers to the date
where a manufacturer will no longer sell a given product.
For example, Microsoft announced that Windows Server 2019
would reach the end of life on January 9th, 2024.
At that time, there will be no new licenses
sold for that operating system,
and no mainstream support, patches,
or updates will be available.
Now, the end of support date, on the other hand,
refers to the last date
that a manufacturer will support a given product.
Going back to my example of Windows Server 2019,
Microsoft has listed an extended end of support date
of January 9th, 2029.
So while you can no longer buy
Windows Server 2019 after 2024,
you can still receive patches, updates, and support
if you have an extended service contract with Microsoft
until 2029.
Now, the reason these end of life
and end of support dates are really important
is that the manufacturer is no longer going to provide
any kind of patches or updates after those dates,
and so you can't keep your system fully up to date
and fully hardened.
And this means attackers are going to be able
to find vulnerabilities in those operating systems
after those EOL and EOS dates,
and then they can attack those legacy end of life
or end of support operating systems
as an open attack surface forever and ever afterwards.
So you need to make sure you're always using a software
that is currently in life and in support.