System hardening

System hardening covers all the technical and organisational measures used to systematically reduce the attack surface of an IT system. It starts from the premise that every installed piece of software, every open network service, every default account and every unnecessary privilege represents a potential point of entry. The goal of hardening is to reduce a system to exactly the functions it needs for its intended purpose and to disable or remove everything else. Typical hardening measures apply to operating systems, databases, web servers, container images, network components and cloud configurations.

Classic measures include disabling or uninstalling unnecessary services and protocols, closing unused ports, removing or renaming default accounts and replacing preset passwords, applying the principle of least privilege, enabling encryption and logging, and maintaining rigorous patch management. In practice, hardening follows recognised configuration guidance such as the CIS Benchmarks, the German BSI IT-Grundschutz recommendations or vendor-specific security configuration guides. These baselines are ideally rolled out in an automated fashion and continuously checked for deviations (configuration drift).

From a regulatory perspective, system hardening is a core building block of an effective information security management system. ISO/IEC 27001 requires appropriate technical safeguards through Annex A controls such as secure configuration (A.8.9), management of technical vulnerabilities (A.8.8) and protection against malware. The BSI IT-Grundschutz addresses hardening in several modules, for example SYS.1.1 (general server). Within the scope of the NIS2 Directive, secure configuration and vulnerability handling are among the required risk management measures under Article 21 NIS2. Hardening is therefore not a one-off project but an ongoing process that must be tightly integrated with vulnerability, patch and change management.