I put together this document as a reference for system hardening. It covers the basics – what hardening actually means, the formula for building a hardened system, and how virtualisation changes the picture.

You can download the full guide as a Word document.

What is System Hardening?

Hardening is just the practice of making a system more resistant to attack. The guiding idea is least privilege: only what’s needed runs, only what’s needed is exposed.

In practice that means knowing which services and applications actually need to be on a box, writing down the policies and standards that govern them, and then configuring the OS, the applications, the database, and the network to match. It also means securing portable equipment and anything else that might slip through the cracks.

Why It Matters

Servers and databases are the foundation. If they’re compromised, everything on top of them is at risk. Hardening isn’t about making a system invincible – it’s about raising the bar so that the easy attacks don’t work, and the hard ones take enough effort that someone moves on.

The Terms

A few definitions to keep straight:

  • Hardened System (H) – the end state you’re working toward.
  • Baseline OS Hardening (Bos) – the foundational security settings for the operating system itself.
  • Application/System Function Hardening (Af) – security configs for specific software: Apache, Oracle, DNS, DHCP, and so on.
  • Base Hardening (B) – the sum of OS hardening and application hardening: B = Bos + Af.
  • Custom Hardening (C) – anything beyond the baseline: DMZ rules, TCP Wrappers, OS-specific controls, the stuff that’s unique to your environment.
  • Virtual System Hardening – hardening the VM layer itself, on top of the guest OS.

The Formula

A hardened system is just base hardening plus custom hardening:

H = B + C

Nothing fancy. You start with the baseline, then layer on whatever your environment needs.

Virtual Environments

Virtualisation adds another piece to the equation. The guest OS still needs its baseline, and the VM itself needs hardening:

H = Vos + B + C

Vos is the virtual OS hardening – hypervisor settings, VM isolation, snapshot policies, that sort of thing. It sits alongside the base and custom layers because a hardened guest on an unhardened hypervisor is still a problem.