Reducing exposure.
WHAT TO DO
Install only what is needed Disable services not in use Restrict network access to what is required Use key-based authentication Disable direct administrative login Keep everything updated
WHAT TO CONFIGURE
Automatic security updates, where appropriate A firewall, default deny Log rotation and retention Time synchronisation
WHAT TO REMOVE
Default accounts Sample files and default pages Unused packages
WHY SAMPLE FILES
They reveal versions and sometimes contain vulnerabilities.
WHAT TO PROTECT
Configuration files, with restrictive permissions Private keys, readable only by their owner
WHAT TO SET
File permissions as restrictively as the application allows.
WHAT NOT TO DO
Broaden permissions to resolve an error.
WHY
The error is then replaced by a compromise.
WHAT TO VERIFY
What is reachable from outside, by scanning from elsewhere.
WHAT TO MONITOR
Authentication attempts Changes to critical files
WHAT TO DOCUMENT
Every hardening decision, so it survives a rebuild.
