Security hardening -

Security hardening means making a system, application, network, or device more secure by reducing vulnerabilities and attack surfaces. It is the process of applying security controls, removing unnecessary features, and configuring systems safely.

In simple terms:

Security hardening = closing unnecessary doors and strengthening the locks.

Examples of security hardening

1. Operating System hardening

Remove unused software
Disable unnecessary services
Apply security patches
Configure firewall rules
Enforce strong passwords
Enable disk encryption
Restrict admin access

Example:

Before:

SSH enabled
Root login allowed
Password authentication enabled
Unused services running

After hardening:

SSH enabled
Root login disabled
Key-based authentication only
Unused services removed
Firewall restricted

2. Application hardening

For an application:

Disable debug mode
Validate user input
Encrypt sensitive data
Use secure headers
Protect APIs
Apply least privilege

Example:

Bad:

debug=true
database password in config file
admin API open to everyone

Hardened:

debug=false
secrets stored securely
API requires authentication

3. Network hardening

Configure firewalls
Close unused ports
Use VPN
Segment networks
Enable IDS/IPS

Example:

Before:

Server:
22 SSH
80 HTTP
443 HTTPS
3306 MySQL
8080 Admin Panel

After:

Internet
   |
Firewall
   |
Only:
443 HTTPS

Internal:
SSH
Database
Admin tools

4. Database hardening

Remove default accounts
Change default passwords
Encrypt connections
Limit permissions
Enable auditing

Example:

Instead of:

app_user:
SELECT, INSERT, UPDATE, DELETE, DROP

Use:

app_user:
SELECT, INSERT, UPDATE

5. Cloud security hardening

Examples:

AWS/Azure/GCP:

Disable public access
Use IAM least privilege
Enable logging
Encrypt storage
Rotate keys

6. User access hardening

Multi-factor authentication (MFA)
Role-based access control (RBAC)
Password policies
Account lockout

Example:

Admin:

Can configure system

Operator:

Can only view/run operations

Common security hardening checklist

Area	Hardening Action
OS	Patch regularly
Accounts	Remove unused users
Passwords	Strong password policy
Network	Close unused ports
Firewall	Allow only required traffic
Services	Disable unnecessary services
Logs	Enable monitoring
Encryption	Use TLS/HTTPS
Access	Least privilege
Backup	Secure backups