Use Standard Hardening Configuration Templates for Application Infrastructure

Systems here mean servers, workstations, active network devices (firewalls, routers, switches, wireless base stations, etc.) and the like. Hardening, on the other hand, means changing the system's settings in such a way that the system's vulnerability area can be reduced.

Organization has defined operating processes through which:

• Only essential features, devices and services (in terms of usage and data processing requirements) are put into use. Redundancies are also removed at the BIOS level.
• There is a procedure in which systems are systematically installed so that the end result is a hardened installation.
• A hardened installation contains only such components and services, and users and processes rights that are necessary to meet operational requirements and ensure security.
• Software such as operating systems, applications, and firmware are set to collect the necessary log information to detect abuse.
• Starting the data system from an unknown (other than defined as primary) is blocked from the device.
• Software (e.g. firmware, applications) is kept up-to-date.
• Connections to the target, including management connections, are limited, hardened, user-identified and time-limited (session timeout).< /li>

Hardening is the practice of reducing system vulnerability by reducing its attack surface.

When configuring virtual machines the organization has to make sure the machines are hardened by, for example, only using ports, protocols and services that are needed. There must also be technical security measures like anti-malware and logging enabled for all virtual machines.

Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.

For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:

• publicly available guidelines (e.g. templates from suppliers and independent security organizations)
• the level of protection required for different assets
• fulfilling related information security requirements
• feasibility and applicability of the configurations to the organization's operations

Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.

The following points should be taken into account when defining standard templates:

• the number of root-level rights is minimized
• unnecessary access rights are disabled
• unnecessary functions and services are deactivated
• access to powerful utilities and important settings is strictly controlled
• the clocks are synchronized
• the supplier's default passwords are changed immediately and the security-related settings are checked
• timeout functions are used if necessary (e.g. automatic logout)
• license requirements are met