All articles
Security EngineeringInfrastructure & Network Security
Browse Knowledge Base

Infrastructure Hardening - Server and OS Security

10 min read

Master infrastructure hardening with server security, OS hardening, patch management, and CIS Benchmarks for secure platform operations.

Infrastructure hardening reduces attack surface and increases attacker cost through systematic removal of unnecessary services, enforcement of secure configurations, and rapid patching. Security engineers deliver paved-road baselines with continuous configuration compliance monitoring and automated remediation. Effective hardening balances security with operational efficiency through immutable infrastructure, automated patching, and comprehensive audit logging.

Unhardened infrastructure enables lateral movement and privilege escalation after initial compromise. Hardened infrastructure contains breaches by limiting what attackers can do. See Cloud Security Fundamentals for cloud-specific hardening.

Baseline Configuration and Image Building

Establishing secure baseline configurations forms the foundation of infrastructure hardening. Organizations must define what a properly hardened system looks like before they can enforce it at scale.

Immutable Infrastructure

Immutable images built from CIS Benchmarks or DISA STIGs provide consistent, hardened baselines across all systems. Security teams should build these images through CI/CD pipelines with reproducible builds, ensuring every deployed system starts from a known-good state. Golden images require regular updates with security patches and configuration improvements, while image versioning enables rollback to previous versions if issues arise.

The core benefit of immutable infrastructure is preventing configuration drift by replacing systems rather than modifying them. When configuration changes are needed, teams create new image builds rather than making in-place modifications. This approach ensures that production systems always match their documented configurations.

Minimal Attack Surface

Minimal package installation reduces attack surface by eliminating unnecessary software. Security teams should install only required packages, conducting regular reviews to identify and remove unused packages that expand the attack surface without providing value.

Unused services present exploitation opportunities and should be disabled systematically. Regular service enumeration identifies unnecessary services that may have been installed as dependencies or left over from testing. Additionally, kernel parameters configured through sysctl should enforce security settings including Address Space Layout Randomization (ASLR), which randomizes memory addresses to make exploitation significantly more difficult.

Filesystem Hardening

Filesystem mount options including noexec, nodev, and nosuid prevent code execution and device file creation on specific filesystems. Temporary directories should be mounted with noexec to prevent malware from executing dropped payloads, a common attacker technique.

Full-disk encryption protects data at rest from physical theft and should be standard for all systems handling sensitive data. Secure /tmp configuration prevents symlink attacks and unauthorized file access, with separate /tmp filesystems and restrictive mount options providing defense-in-depth protection.

Access Control and Identity

Controlling who can access infrastructure and what they can do represents a critical hardening domain. Weak access controls enable attackers to escalate privileges and move laterally after initial compromise.

Account Management

Shared accounts must be eliminated in favor of individual accounts for all users, enabling attribution and accountability when investigating security incidents. When multiple people share credentials, organizations cannot determine who performed specific actions.

SSH access should use SSO integration with short-lived certificates rather than long-lived keys. Certificate-based authentication enables centralized access control and automatic expiration, eliminating the risk of forgotten or compromised keys persisting indefinitely. Password authentication should be disabled entirely for SSH, requiring key-based or certificate-based authentication, with multi-factor authentication mandatory for administrative access.

Privilege Management

PAM (Pluggable Authentication Modules) restrictions enforce password policies, account lockout, and session limits across the system. PAM configuration should follow security best practices and be validated against CIS Benchmarks.

Sudo should be configured for specific commands rather than providing full shell access where possible. Command-specific sudo configurations reduce privilege escalation risks by limiting what authenticated users can do. Session recording for privileged operations provides audit trails essential for security investigations, capturing all administrative actions for later review.

Patch and Configuration Management

Keeping systems patched and properly configured requires automation and clear processes. Manual approaches cannot scale to modern infrastructure demands and leave systems vulnerable during patching delays.

Automated Patching

Automated patch windows with canary deployments enable rapid patching with minimal risk. Canary systems receive patches first, with comprehensive monitoring for issues before broader deployment proceeds. This approach balances the need for rapid security updates against operational stability concerns.

Rollback procedures should be tested regularly, enabling rapid recovery from problematic patches. Automated rollback based on health checks reduces manual intervention and shortens recovery time when issues arise. Emergency patch playbooks document how to rapidly deploy critical security patches outside normal windows, and these emergency procedures require regular testing to ensure they work when needed.

Configuration as Code

Configuration management through tools like Ansible, Chef, Puppet, or Salt enables version-controlled, auditable configuration. Configuration as code prevents configuration drift and enables rapid deployment of standardized settings across the infrastructure. For securing infrastructure-as-code workflows, see Infrastructure as Code Security.

Drift detection identifies systems with configurations that differ from desired state, enabling automated remediation to correct deviations automatically. Configuration changes should always be tested in non-production environments before production deployment, preventing configuration errors from causing outages or security gaps.

Vulnerability Management

Vulnerability management should be tied to Service Level Objectives (SLOs) that define maximum remediation times based on severity. Critical vulnerabilities may require remediation within 24 hours, while lower severity issues receive longer remediation windows. For comprehensive vulnerability management practices, see Vulnerability Management.

Exceptions to patching requirements should be time-bounded with compensating controls documented and approved by security leadership. These exceptions require regular review and elimination when compensating controls are no longer necessary. Vulnerability scanning should occur continuously, identifying new vulnerabilities as they are disclosed and integrating scan results with patch management workflows.

Logging and Monitoring

Comprehensive logging enables detection of security incidents and provides evidence for investigations. Without proper logging, organizations cannot determine what happened during a breach or identify compromised systems.

Comprehensive Audit Logging

Centralized logging with tamper-evident storage prevents attackers from covering their tracks by modifying or deleting local logs. Logs should be forwarded to centralized systems in real-time, ensuring that even if attackers compromise a system, the evidence of their actions has already been preserved elsewhere.

Kernel auditing through auditd captures system calls and security-relevant events at the lowest level. Audit rules should cover file access, process execution, and network connections to provide comprehensive visibility into system activity. Process accounting logs all process executions, enabling investigation of malicious activity, while command logging for administrative sessions captures all commands executed by privileged users.

Endpoint Detection and Response

EDR agents provide endpoint telemetry including process execution, network connections, and file modifications. Security teams should deploy EDR with careful attention to performance impact, as excessive overhead can affect production workloads.

EDR alerts should integrate directly with incident response workflows, enabling rapid investigation and response when suspicious activity is detected. Alert tuning reduces false positives while maintaining detection coverage, ensuring that security teams can focus on genuine threats rather than chasing benign activity.

Network Hardening

Network-level controls complement host hardening by limiting what network traffic can reach systems and where compromised systems can connect. Defense in depth requires both host and network controls working together.

Host-Based Firewalls

Default deny host firewalls block all traffic except explicitly allowed connections, ensuring that even if network-level controls fail, hosts reject unauthorized connections. Firewall rules should follow least privilege principles, allowing only the traffic required for the system to function.

Egress filtering through proxies enables monitoring and control of outbound connections, detecting command-and-control communications and data exfiltration attempts. Proxy logs provide visibility into external communications that would otherwise be invisible to security monitoring. Administrative interfaces should be locked down to specific source IP addresses or networks, and management interfaces should never be exposed directly to the internet.

Network Segmentation

Management networks should be isolated from production networks, preventing lateral movement from compromised production systems to management infrastructure. This isolation ensures that even if attackers compromise production workloads, they cannot easily pivot to infrastructure that controls the entire environment.

Network segmentation limits blast radius from compromises by preventing attackers from accessing all systems from any foothold. Segmentation boundaries should align with trust boundaries, separating systems with different security requirements and data sensitivity levels.

Cloud and Virtualization Hardening

Cloud environments require hardening approaches that leverage cloud-native security controls while applying traditional hardening principles. The shared responsibility model means organizations must harden the components they control.

Account Isolation

Separate cloud accounts or projects per environment prevent development environment compromises from affecting production systems. Account isolation provides strong security boundaries that are difficult to bypass even with compromised credentials, as IAM permissions are scoped to individual accounts.

Service Control Policies (SCPs) or organization policies enforce guardrails across accounts, preventing insecure configurations regardless of individual account permissions. Policies should be tested in permissive mode before enforcement to avoid disrupting legitimate workloads.

Control Plane Security

Control plane isolation from workloads prevents workload compromises from affecting infrastructure management. Control plane access should be strictly limited to authorized personnel with appropriate authentication and authorization controls.

Snapshot and image encryption protects data at rest in backups and templates, ensuring that even if storage is compromised, data remains protected. Encryption keys should be managed through KMS or HSM with appropriate access controls and rotation policies. Cross-account backup vaults provide additional protection by separating backup encryption keys from production keys, ensuring that compromised production credentials cannot access backup data.

Container Host Hardening

Container hosts require specialized hardening because they run untrusted workloads that share the kernel. For comprehensive container and orchestration security beyond host hardening, see Container and Kubernetes Security.

Kernel Attack Surface Reduction

Container hosts should be hardened to limit kernel attack surface, as container escapes often exploit kernel vulnerabilities. Minimal host operating systems including Container-Optimized OS or Bottlerocket reduce attack surface by eliminating unnecessary packages and services that could be exploited.

AppArmor or SELinux mandatory access control provides additional containment beyond standard Linux permissions, restricting what containers can do even if they escape initial isolation. MAC policies should be enforced for all containers with profiles tailored to each workload's requirements.

Runtime Security

Containers should run with minimal runtime privileges, avoiding privileged containers where possible. Capabilities should be dropped to the minimum required set, preventing containers from performing actions they do not legitimately need.

Read-only root filesystems prevent container modification, limiting attacker capabilities by blocking persistent changes to container images. Writable volumes should be minimised and monitored for suspicious activity. Seccomp profiles restrict system calls available to containers, preventing exploitation of kernel vulnerabilities through unused system call interfaces.

Compliance and Validation

Hardening is only effective if organizations can verify that systems actually meet baseline requirements. Compliance validation provides assurance that hardening controls are properly implemented and maintained.

Baseline Compliance

Automated compliance scanning validates that systems meet baseline requirements on an ongoing basis. Compliance violations should trigger alerts and remediation workflows, ensuring that deviations are corrected quickly rather than persisting indefinitely.

CIS Benchmarks provide industry-standard hardening guidelines for operating systems, databases, and applications, offering detailed configuration recommendations with rationale. DISA STIGs provide government hardening standards required for systems handling classified or sensitive government data. For risk assessment approaches that inform hardening priorities, see Risk Assessment.

Continuous Validation

Hardening should be validated continuously rather than through point-in-time assessments that provide only a snapshot of compliance. Continuous validation detects configuration drift and unauthorized changes as they occur, enabling rapid remediation.

Penetration testing validates that hardening controls are effective against real attacks by simulating adversary techniques. Testing should occur regularly with findings driving hardening improvements in a continuous feedback loop that strengthens defenses over time.

Conclusion

Infrastructure hardening requires systematic attack surface reduction, automated configuration management, and continuous compliance validation. Security engineers design hardening programs that balance security with operational efficiency through automation and immutable infrastructure.

Success requires treating hardening as continuous process rather than one-time effort, with regular updates to baselines and rapid patching of vulnerabilities. Organizations that invest in infrastructure hardening fundamentals reduce breach impact while demonstrating security controls to auditors and customers.

Related Articles

References

Previous

Infrastructure as Code Security: IaC Scanning, Policy-as-Code & Terraform Best Practices

Next

Input Validation & Output Encoding - Injection Prevention