Hardening Flashcards
What is Hardening?
Configuring an operating system and applications to reduce security vulnerabilities
*Relevant for servers, mobile devices and laptops
Why is physical security important in hardening?
Compromised devices are hard to detect, and encryption helps protect data
Attack Surface Reduction
Remove unnecessary components
Sandboxing
Limits resources that applications/processes can access
Examples of sandboxing
Web browsers running processes in isolated environments
Virtual machines for running different services
Difference between SELinux and AppArmor?
SELinux expressive but complex, AppArmor is easier to use and the default in Ubuntu
What is the purpose of SUID/SGID binaries?
Temporarily elevate privileges for specific tasks (e.g., password management).
What is a major risk of SUID binaries?
Vulnerable binaries can lead to privilege escalation.
Anti-Forensics Techniques
Encrypt storage to make data harder to recove after deletion
What is full disk encryption, and what is a common problem?
Encrypts the entire disk. Without the key, the system cannot boot.
What is Nmap, and what is it used for?
A network scanner to identify exposed attack surfaces.
What is Snort, and how does it work?
A network-based intrusion detection system using rule-based signatures.
What are common steps for SSH hardening?
Disable password access, enforce public key authentication, and enable MFA.
What does rsyslogd do?
Centralizes log management with encrypted transport.
