How to Build a Secure Hardening Program

Commercial and open-source system configurations do not always have the necessary security measures in place to be deployed immediately into production. These out-of-the-box configurations often have features and functionalities enabled by default that are unnecessarily “open” or “on” which makes them less secure and more vulnerable and susceptible to exploitation, especially given the sophistication and resourcefulness of today’s cybercriminals. A secure hardening program can help address this issue by disabling or removing unnecessary features and functionalities. This proactively minimizes vulnerabilities, enhances system maintenance, helps support compliance requirements, and ultimately reduces a system’s overall attack surface.

Unfortunately, many companies lack a mature hardening program because they have neither an accurate IT asset inventory nor the resources to holistically implement or maintain a program. An ideal secure hardening program can successfully track, inventory, and manage the various platforms and assets deployed within an IT environment throughout their life cycles. Without this information, it is difficult to fully verify that configurations are hardened and secure.

Planning and Implementing Your Secure Hardening Program

Secure hardening is more than just the activity of creating configuration standards. It also involves identifying and tracking assets in your environment, establishing a robust configuration management approach, and configuring and maintaining system parameters to expected values. To manage and promote secure hardening throughout your organization, start by initiating an enterprise-wide program. Most companies are engaged in various stages of a plan but suffer from an inconsistent approach and execution.

A plan builds on the premise that the hardening standards will address the most common platforms such as Windows and Linux and IT asset classes such as servers, databases, and network devices. These standards will generally address approximately 80% of the platforms and IT asset classes deployed in the environment. The remaining 20% may be unique and require additional research or effort in validating the most appropriate hardening standard and the best implementation approach. By adopting the 80/20 rule, hardening will become more consistent, providing better coverage and increase the likelihood of continued success.

Let’s take a closer look at the components of a secure hardening program and outline the steps you can take to get started on your journey:

1. Confirm Platforms and IT Asset Classes

2. Determine the Scope of Your Project

3. Establish Secure Hardening Standards

4. Implement Your Secure Hardening Standards

5. Monitor and Maintain Your Program

1. Confirm Platforms and IT Asset Classes

First things first: Determine the types of platforms and IT asset classes deployed within the environment which would include operating systems, software, hardware, and firmware. For example, identify and document the types of server operating systems such as Windows, Linux and Ubuntu and their versions; identify and document the types of databases such as MySQL, Oracle or MongoDB and their versions. The IT asset inventory should be able to report on the data needed to create the platform and IT asset class list. However, companies continue to be challenged with maintaining an IT asset inventory where they can accurately account for, locate, and track the IT assets in their environment.

If there isn’t an up-to-date IT asset inventory to report from, then review discovery scan reports to create a list of platforms and asset classes. The scan reports will help verify and validate existing platforms and IT asset classes in the environment as well as devices that may be unique to your company or industry. Interviewing IT tower leads can also support this information-gathering exercise, as can general institutional knowledge about what is deployed.

2. Determine the Scope of Your Project

Once you’ve documented the platforms and IT asset classes, you can determine the full scope of the secure hardening program. From a security perspective, all identified platforms and IT asset classes should be in scope, but if any platform or IT asset class is excluded, document a formalized rationale or justification for the exception. Keep in mind that any platform or IT asset class not included in the hardening scope will likely increase the level of risk within the environment unless compensating controls or countermeasures are implemented.

3. Establish Secure Hardening Standards

Next, develop hardening builds or confirm existing builds for all in-scope platforms and IT asset classes. Create this documentation initially from industry-recognized, authoritative sources. The Center for Internet Security (CIS), and the Security Technical Implementation Guides (STIGs) are industry-recognized hardening guides for securely configuring systems and can be universally applied. Both sources are free to the public. It is generally best to leverage hardening standards from one primary source and use secondary and tertiary sources when a primary does not exist.

This is the step where you’ll reference the in-scope listing of all platforms and IT asset classes. For each line item on the list, there should be a corresponding hardening standard document. Start with the industry-recognized source hardening standards and customize them as necessary with the requisite stakeholders.

As an example, let’s say the Microsoft Windows Server 2022 operating system needs a hardening standard and the decision was made to leverage the Center for Internet Security guides. First, download the Microsoft Windows Server 2022 spreadsheet guide from the CIS website. After orienting the Windows Server team to the overall program objectives, share the hardening guide and request that they review in advance of scheduled meetings. Meet with the Windows Server team and walk through the guide to determine if the configuration settings are appropriate.

During these discussions, the Windows Server team verifies what configuration settings are or are not currently in place, and what may violate company policy for pre- and post-production server images. If there are hardening configuration settings that are not already in place, then formal testing should occur to ensure these changes will not create any performance, outage, or other issues within the production environment. For example, the configuration setting “Ensure ‘Enable password encryption’ is set to Enabled” is a Microsoft Windows Server 2022 hardening requirement from the CIS guide. If this configuration setting is not already enabled, then can it be? Then, determine through testing if it cannot be enabled and document the reason whether it causes problems as determined through testing, it violates company policy or anything else that justifies an exception. Document and manage this configuration setting as an exception.

4. Implement Your Secure Hardening Standards

After you’ve established the hardening build and maintenance documentation and conducted any necessary configuration testing, implement the hardening standards accordingly. The pre-production “golden” or base images should be hardened initially to proactively disable or remove unnecessary features and functionality prior to deploying in production. Starting with the preproduction images should be less time and labor intensive because only one image per platform is typically required to be hardened, removing the need for a change management process or scheduled downtime.

Once a particular image is hardened, then that image can be used to re-image the postproduction IT assets already deployed in the environment. The hardened configuration changes can be deployed through automation with configuration management tools, or manually if necessary. For example, the Windows team can implement a vast array of configuration settings throughout the environment they manage with Group Policy.

5. Monitor and Maintain Your Program

An effective secure hardening program requires the support of management and all IT and security teams throughout the company. The success of a program has as much to do with people and processes as it does with technology. Since secure hardening is inherently interdisciplinary and interdepartmental, a variety of skill sets are needed to carry it out. Hardening is a team effort that requires extensive coordination and collaboration.

It’s important to appoint a configuration management lead to ensure accountability and responsibility for the management and oversight of the program. This individual should possess the drive to achieve results, have a knack for problem-solving, and the ability to direct others in collaboration and teamwork. The lead serves in a governance role by monitoring the hardening practices of all teams and challenging poor processes and approaches. The configuration management lead is ultimately responsible for the success of the program and should provide the focus, support, and momentum necessary to achieve its objectives.

Still, responsibility for hardening-related activities should be formally assigned to the teams best suited to ensure their completion and maintenance. Security teams should help facilitate improvements when gaps are identified and support verifying compliance against agreed-upon hardening standards. If configuration management tools are not available, the verify compliance using vulnerability scans.

All this complexity demands a great deal of synchronization. The roles and responsibilities must be clearly delineated so teams can focus their efforts on activities that truly advance the secure hardening program.

Secure Hardening Has Never Been So Crucial

Implementing and managing an effective secure hardening program requires leadership, teamwork, security knowledge and execution. By obtaining executive commitment, management support and sufficient investment for the program, you’ll see incremental improvements in program execution and support.

Companies everywhere and across industries face an ever-accelerating rate of change in both the threat and technology landscapes, making secure hardening more crucial than ever. A secure hardening program isn’t built in a day. But an effective, thoughtfully constructed program can significantly lower your company’s risk posture.