What is OS hardening?
Operating system (OS) hardening, a facet of system hardening, involves the implementation of security measures of operating systems like Windows, Linux, or macOS (aka OS X) to bolster their defenses against cyber attacks and data breaches. The primary aim of addressing security risks for hardening security measures of these applications is to ensure they are protected against potential security vulnerabilities.
What are OS hardening standards?
CIS Benchmarks offer consensus-based security configurations for OS, apps, and devices. They’re widely used and accessible on the CIS website.
NIST SP 800-53 outlines a framework for OS security compliance, a trusted standard in the US, found on the NIST website.
DISA STIGs provide detailed security guides for OS, particularly in government and military settings. They’re available on the DISA website.
PCI DSS focuses on securing payment card data but includes OS security requirements. Guidance is available on the PCI SSC website.
Vendors like Microsoft, Linux, and Apple offer their own OS security guidelines, such as Microsoft’s “Security Baseline” for Windows.
Types of Operating Systems
The choice of an operating system often depends on factors such as personal preferences, hardware compatibility, software requirements, and the specific use case (personal, business, gaming, development, etc.). Each operating system has its strengths and weaknesses, and users typically choose the one that best aligns with their needs and the intended usage scenario.
20 Operating system hardening best practices
While each operating system possesses distinct attributes, several hardening practices are universally applicable across different platforms. Below, you’ll find 20 essential OS hardening best practices to to address the different types of system hardening:
- Regular OS Patch Management: Keep the OS and all installed software up to date by applying patches and updates to address known vulnerabilities.
- User Account Management: Implement strong password policies, including password complexity and regular password changes.
- Restrict Creation of User Accounts: Restrict user privileges to the minimum necessary for their tasks and remove or disable unnecessary user accounts.
- Access Control: Implement the principle of least privilege and configure access control lists (ACLs) and file permissions to restrict unauthorized access to files and directories.
- Enabling only the necessary ports and services: Disable or remove unnecessary software and processes to reduce the attack surface.
- Intrusion Detection System (IDS): implement an IDS to monitor and analyze network traffic for signs of suspicious activity.
- Logging and Auditing: Enable and configure logging and auditing mechanisms to monitor system activities and security events.
- Monitoring: Regularly review and analyze logs to identify and respond to security incidents.
- OS Updates and Configuration Review: Periodically review and update the security configuration to adapt to new threats and security best practices.
- Vulnerability Scanning: Regularly scan the system for vulnerabilities and weaknesses and address them promptly.
- Software Whitelisting: Allow only authorized and trusted software to run on the system and block or restrict unapproved applications.
- Incident Response Planning: Develop an incident response plan to address and recover from security incidents effectively.
- Encryption: Implement encryption for data at rest and data in transit to protect sensitive information.
- Vendor-Specific Recommendations: Follow the OS vendor’s security guidelines and best practices for the specific operating system in use.
- Firewall Configuration: Use firewalls to filter network traffic and control access to the system.
- Network Configuration: Limit open ports and services to minimize exposure to the network.
- Communications Protocol: Implement secure communication protocols and disable insecure ones.
- Antivirus and Anti-malware: Install and maintain antivirus and anti-malware software to detect and remove malicious software.
- Data Resilience: Regularly backup critical system data and configuration settings and store them in an offline or secure location to ensure data recovery in case of system compromise or failure.
- Awareness Programs: Educate system users and administrators about security best practices, common threats, and how to recognize and respond to security incidents
Operating System Hardening Checklist
By automating the OS hardening process, IT professionals can reduce the time and effort required for server hardening, while also improving its security posture and compliance with regulatory requirements.
This OS hardening checklist can serve as a useful tool to guide IT professionals in this process, providing a starting point for setting up secure configurations and keeping track of progress:
Section 1: User Secure Configuration
- Establish secure configurations for various enterprise assets:
- End-user devices (laptops, smartphones, tablets)
- Non-computing and IoT devices
- Servers
- Implement secure settings for:
- Operating systems
- Software applications
- Regularly review and update configuration process documentation:
- Conduct annual reviews
- Update documentation when significant enterprise changes occur
- Ensure alignment with changing security requirements and technologies.
Section 2: Network Configuration
- Develop and sustain a secure configuration process dedicated to network access and devices.
- Periodically assess and enhance the process documentation:
- Perform an annual documentation review.
- Promptly update documentation when substantial enterprise modifications are made that might affect the established safeguard.
- Ensure that the configuration process remains aligned with evolving security demands and alterations in the enterprise environment.
Section 3: Configure Automatic Locking for Enterprise Devices
- Set up automatic session locking on enterprise assets following a specified period of user inactivity.
- Adhere to specific time limits for different types of devices:
- For general-purpose operating systems, the idle period should not surpass 15 minutes.
- On mobile end-user devices, the idle period should not go beyond 2 minutes.
Section 4: Server Firewall Configuration
- Deploy and oversee a firewall on servers, utilizing available options.
- Potential implementations encompass:
- Virtual firewall setup.
- Operating system firewall configuration.
- Integration of a third-party firewall agent.
Section 5: End-User Device Firewall Configuration
- Set up and oversee a host-based firewall or port-filtering tool on end-user devices.
- Enforce a default-deny rule that blocks all network traffic, except for explicitly permitted services and ports.
Section 6: Device and Software Configuration
- Implement secure management practices with restricted access for enterprise assets and software.
- Employ methods like version-controlled infrastructure-as-code for configuration management.
- Access administrative interfaces using secure network protocols, such as SSH and HTTPS.
- Avoid utilizing insecure management protocols like Telnet and HTTP, unless they are operationally necessary.
Section 7: Control Default Accounts
- Administer default accounts on enterprise assets and software, which encompass accounts like root, administrator, and pre-configured vendor accounts.
- Implement various approaches, such as:
- Disabling default accounts.
- Rendering default accounts unusable.
Section 8: Minimize Unnecessary Services
- Remove or deactivate redudent services on enterprise assets and software.
- Examples of these services include:
- Unused file sharing services.
- Web application modules that are not in use.
- Service functions that are unnecessary.
Section 9: Trusted DNS Server Configuration
- Set up reliable DNS servers on enterprise assets.
- Implementations might involve:
- Configuring assets to rely on DNS servers managed by the enterprise.
- Using well-regarded externally accessible DNS servers.
Section 10: Portable End-user Device Lockout Configuration
- Implement an automatic device lockout mechanism after a specific number of local authentication failures on portable end-user devices.
- Set thresholds as follows:
- For laptops, trigger lockout after no more than 20 failed authentication attempts.
- For tablets and smartphones, initiate lockout after no more than 10 failed authentication attempts.
- Illustrative implementations encompass tools like Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.
Section 11: Portable End-user Remote Device Lockout Configuration
- Enable remote data wiping for enterprise-owned portable end-user devices, based on specific situations like:
- Lost or stolen devices.
- Individuals no longer associated with the enterprise.
- Initiate the remote wipe process when appropriate.
- Ensure that this capability is aligned with enterprise policies and security needs.
Section 12: Isolate Enterprise Workspaces on Mobile Device Configuration:
- Establish distinct enterprise workspaces on mobile end-user devices, leveraging supported capabilities.
- Implementations can involve techniques like:
- Utilizing Apple Configuration Profile or Android Work Profile.
- Ensure that enterprise applications and data are isolated from personal applications and data within these separate workspaces.
