Free through lesson 3

System Hardening

Attack surface and least privilege, baselines, Linux and Windows settings, web, TLS and databases, containers and cloud, and configuration as code with automated checks. In 30 lessons you learn to find and shrink the attack surface yourself.

Start from lesson 1 Unlock every course

Curriculum

The 30 lessons are grouped into six chapters. Working through from chapter 1 is recommended, but you can also dip into the parts you need. * Standard-library Python runs right in the browser. All commands and logs come from fictional hosts.

Chapter 1 — How to think about hardening (lessons 1–5)

Attack surface, least privilege, defence in depth, baselines, and how to roll out changes safely.

What is the attack surface?

The idea of the attack surface, the starting point of hardening. Count it through four entry points (services, accounts, software, configuration) and then remove, narrow and watch.

Free

Least privilege and defence in depth

The two principles behind hardening. Grant only the rights needed, only for as long as needed, and stack layers of defence that do not depend on each other.

Free

Working from baselines

Using baselines such as the CIS Benchmarks: Level 1 versus Level 2, reading a recommendation, and tailoring it into your own standard instead of applying it blindly.

Free

Inventory of assets and configuration

The inventory you take before hardening. Collect hosts, packages, services and accounts, compare them with the expected state, and find the differences.

Rolling out changes safely

How to avoid outages from hardening changes. Test first, roll out in stages, decide how to roll back before you start, and keep a change record.

Chapter 2 — Hardening Linux (lessons 6–10)

Reviewing services, accounts, SSH, file permissions, kernel settings and the firewall.

Stopping unneeded services

List running services and listening ports, and stop what is not needed. The difference between stop, disable and mask, and the sockets and timers people forget.

Accounts and sudo

Inventory of accounts that can log in and locking unused ones. Password policy, and writing sudoers rules that allow only the commands people need.

Configuring SSH

Make SSH key-only, disable root login and password authentication, and limit which groups may log in. Check the values actually in effect with sshd -T.

File permissions

Set default permissions with umask, find world-writable and SUID/SGID files with find, and restrict places like /tmp with mount options.

Kernel and network settings

Use sysctl to tighten kernel network behaviour and what the kernel reveals, and build a default-deny firewall with ufw or nftables that allows only what is needed.

Chapter 3 — Hardening Windows (lessons 11–15)

Baseline settings, administrator rights, Group Policy, application control and governing PowerShell.

Windows Baseline Settings

Updates, Microsoft Defender, SmartScreen and the three firewall profiles, and how to check with PowerShell that the built-in protections are actually on.

Accounts and Administrator Rights

Inventorying local Administrators against an allow list, per-device admin passwords with Windows LAPS, UAC, and separate admin accounts.

Aligning Settings with Group Policy

How GPOs are applied and how to see which settings are really in effect, then rolling out the Microsoft Security Compliance Toolkit baselines in stages after reviewing the differences.

Attack Surface Reduction Rules and Application Control

Rolling out Microsoft Defender ASR rules starting in audit mode, and allow-list control with App Control for Business (formerly WDAC) and AppLocker.

Governing PowerShell and Scripts

Why the execution policy is not a security boundary, script block logging (4104) and transcription, Constrained Language mode, and dealing with the old PowerShell 2.0.

Chapter 4 — Services and applications (lessons 16–20)

Hardening web servers, TLS, databases, secrets and dependencies.

Web Server Configuration

Turning off version banners and directory listings and setting security headers, with nginx and Apache examples and an automated header check.

Configuring TLS

Why to allow only TLS 1.2 and 1.3, choosing cipher suites with forward secrecy, shrinking certificate lifetimes and automatic renewal, and introducing HSTS in stages.

Hardening Databases

Keeping databases off the network, enforcing authentication and TLS with pg_hba.conf, least privilege for application roles, and encrypting traffic, stored data and backups.

Managing Secrets

Keeping passwords, API keys and private keys out of code: secret stores, rotation, detection before commit, and the order of steps when something leaks.

Dependencies and Patch Management

Knowing what you run with an SBOM, finding issues with vulnerability scanning, prioritising by severity, exposure and exploitation, and setting patch SLAs.

Chapter 5 — Containers and cloud (lessons 21–25)

Reviewing container images and runtime settings, Kubernetes, and cloud identity, networking and storage.

Hardening container images

Put less into the image, run it as a non-root user and pin versions. Use multi-stage builds and image scanning to find weaknesses before shipping.

Container runtime settings

Avoid privileged mode, drop capabilities, make the filesystem read-only and set resource limits. Audit Compose settings with Python.

Kubernetes basics

Limit people and service accounts with RBAC, stop dangerous Pods with the Pod Security Standards, and restrict traffic with NetworkPolicy. Verify it all with kubectl.

Cloud identity and permissions

In the cloud, identity is the perimeter. Least-privilege policies, the root user and MFA, and working without long-lived access keys, checked by auditing an AWS credential report.

Cloud networking and storage

Narrow exposure with security groups and close administrative entry points. Prevent storage accidents with S3 Block Public Access and default encryption.

Chapter 6 — Keeping it hardened (lessons 26–30)

Managing configuration as code, checking it automatically, and tracking exceptions and results. The course ends with a hardening checklist.

Managing configuration as code

Manual configuration always drifts. Turn settings into code with IaC, check them with policy as code, and find and correct drift from the real environment.

Checking automatically

Check baseline compliance mechanically with tools such as OpenSCAP and CIS-CAT. Build scans into CI and stop on serious findings.

Managing exceptions

Record items that cannot be fixed right away as exceptions with an owner, a reason, compensating controls and an expiry date. Catch expired ones and tie tool suppressions to the register.

Measuring the effect of hardening

Measure the attack surface itself, such as ports reachable from outside and days left unfixed, not just compliance rates. Confirm fixes by rescanning and report the trend.

Wrap-up: building a hardening checklist

Using a fictional online shop, turn this course into a checklist organised by layer. Add operational items, tally the status and decide what to do next.

Once you have finished all 30 lessons, move on to the Reconnaissance course in the Red track. See the order of courses on the security track page. Membership unlocks every course.