Host Hardening

Overview

Secure server configuration: firewall, SSH hardening, user management, baseline security settings.

Why It Matters

Reduce attack surface. CIS benchmarks, unnecessary services disabled.

The Risk

Implementation Components

A complete implementation of this capability includes:

• CIS benchmark application for your OS
• SSH hardening (key-only auth, no root login)
• Firewall configuration with default-deny
• Unnecessary services disabled
• Regular security scanning (Lynis)
• Automated hardening via configuration management

Implementation Pattern

1. 1Apply security benchmarks
2. 2Configure firewall
3. 3Harden SSH
4. 4Disable unused services

Pipeline Coverage

This continuous capability monitors and applies to the following pipeline phases:

Tool Examples

These are examples, not endorsements. Choose what fits your context.