Hardening is the process of reducing a system’s attack surface by turning off unnecessary services, removing default or unused accounts, applying patches, tightening file permissions, and configuring settings to a known secure standard. A fresh operating system ships with plenty enabled for convenience, and every feature nobody uses is one more door an attacker can try.
The Center for Internet Security publishes CIS Benchmarks with concrete settings for Windows, Linux, databases, web servers, and cloud platforms, while DISA STIGs play the same role for Department of Defense systems. Hardening is not a one-time task, which is where teams stumble. Configuration drift creeps in as admins make changes over months, so a box hardened at build time slowly loosens. Pairing baselines with change management and periodic configuration audits keeps the gains from eroding.
Why does hardening matter for the CISSP exam?
Hardening shows up in Domain 7: Security Operations as an ongoing operational practice, and it connects to secure design work in Domain 3. Candidates should know how secure baselines are established, applied, and maintained across a system’s life, and how hardening relates to but differs from configuration management.