Cyberstudy
PDF p.264 In progress

Hardening Techniques

Open PDF at p.264 34 flashcards

Summary

PDF p.264

Hardening techniques protect endpoints against evolving cybersecurity threats by addressing vulnerabilities at multiple levels, including physical access, network protocols, operating system configurations, and user behaviors.

In plain words

Supplementary — not from your PDF

Hardening works at many levels. Physical ports: disable unused USB and serial ports, use port control software, set UEFI/BIOS passwords. Logical ports: host firewalls with default-deny. Encryption: full disk, removable media, VPN and email. Endpoint protection: deploy in planned stages, standardize, automate (SCCM, GPO), monitor and manage centrally. Also change defaults, remove unneeded software, update firmware, and use HTTPS and SNMPv3. When decommissioning, sanitize, factory reset, destroy if needed, and update the inventory.

Detailed explanation

PDF p.264
  • Protecting Ports
    • Physical Ports: Disable unnecessary ports (USB, HDMI, serial) to prevent unauthorized access.
    • Port Control Software: Allows only authorized devices to connect.
    • Firmware/UEFI/BIOS Settings: Disable ports or require passwords for booting from nonstandard sources.
    • Logical Ports: Use firewalls and service hardening to secure software-based communication features.
  • Encryption Techniques
    • Full Disk Encryption (FDE): Encrypts entire hard drive, protecting all data.
    • Removable Media Encryption: Protects data on removable devices.
    • Virtual Private Networks (VPNs): Secure data transmission.
    • Email Encryption: Protects sensitive email information.
  • Host-Based Firewalls and IPS
    • Default-Deny Policies: Block all traffic unless explicitly allowed.
    • Traffic Filtering: Block or allow traffic based on parameters.
    • Application Control: Permit only trusted applications to communicate.
    • Integration with SIEM: Supports rapid detection and response.
  • Installing Endpoint Protection
    • Deployment Plan: Consider order, time frames, and stages.
    • Standardize Configurations: Ensure consistency across devices.
    • Automate Deployments: Use tools like SCCM or Group Policy.
    • Updates and Patches: Keep software and definitions current.
    • Monitor Agents: Check for alerts and verify updates.
    • Centralize Management: Enforce global security policies.
  • Changing Defaults and Removing Unnecessary Software
    • Default Passwords: Change to strong, unique credentials.
    • Unnecessary Software: Remove to reduce attack surface.
    • Firmware Updates: Patch known vulnerabilities.
    • Encrypted Protocols: Use HTTPS and SNMPv3 for secure management.
  • Decommissioning
    • Data Sanitization: Securely erase all data.
    • Factory Reset: Remove residual configurations.
    • Physical Destruction: Destroy sensitive components.
    • Documentation: Update inventory records.

Important terms

taken from the text above
Physical Ports
Disable unnecessary ports (USB, HDMI, serial) to prevent unauthorized access.
Port Control Software
Allows only authorized devices to connect.
Firmware/UEFI/BIOS Settings
Disable ports or require passwords for booting from nonstandard sources.
Logical Ports
Use firewalls and service hardening to secure software-based communication features.
Full Disk Encryption (FDE)
Encrypts entire hard drive, protecting all data.
Removable Media Encryption
Protects data on removable devices.
Virtual Private Networks (VPNs)
Secure data transmission.
Email Encryption
Protects sensitive email information.
Default-Deny Policies
Block all traffic unless explicitly allowed.
Traffic Filtering
Block or allow traffic based on parameters.
Application Control
Permit only trusted applications to communicate.
Integration with SIEM
Supports rapid detection and response.
Deployment Plan
Consider order, time frames, and stages.
Standardize Configurations
Ensure consistency across devices.
Automate Deployments
Use tools like SCCM or Group Policy.
Updates and Patches
Keep software and definitions current.
Monitor Agents
Check for alerts and verify updates.
Centralize Management
Enforce global security policies.
Default Passwords
Change to strong, unique credentials.
Unnecessary Software
Remove to reduce attack surface.
Firmware Updates
Patch known vulnerabilities.
Encrypted Protocols
Use HTTPS and SNMPv3 for secure management.
Data Sanitization
Securely erase all data.
Factory Reset
Remove residual configurations.
Physical Destruction
Destroy sensitive components.
Documentation
Update inventory records.
FDE Full Disk Encryption VPNs Virtual Private Networks

Examples & real-world scenarios

Supplementary — not from your PDF
  • A UEFI password preventing booting from USB.
  • A host firewall set to deny all inbound traffic except approved apps.
  • Updating the asset inventory when a laptop is retired.

Scenario

A laptop is retired and resold without a data wipe, and the old inventory record says it's still in use. Proper decommissioning (sanitize, reset, update records) prevents both a data leak and inventory errors.

Common mistakes

Supplementary — not from your PDF
  • Forgetting firmware and UEFI settings when hardening.
  • Skipping documentation when decommissioning.

Practical skills

Supplementary — not from your PDF
  • Write a decommissioning checklist.

What I should remember

Key Points PDF p.264
  • Protecting Ports: Disable unnecessary physical and logical ports.
  • Encryption Techniques: Use FDE, removable media encryption, VPNs, and email encryption.
  • Host-Based Firewalls and IPS: Implement default-deny policies, traffic filtering, and application control.
  • Installing Endpoint Protection: Plan deployment, standardize configurations, automate updates, monitor agents, and centralize management.
  • Changing Defaults and Removing Unnecessary Software: Change default passwords, remove unnecessary software, apply firmware updates, and use encrypted protocols.
  • Decommissioning: Securely erase data, reset to factory settings, destroy sensitive components, and update inventory records.