← Home

System Hardening

System hardening is the process of securing a system by reducing its attack surface — the set of available vectors an attacker can use. Typical measures include removing unnecessary software and user accounts, enforcing strong access controls (for example multifactor authentication), disabling or removing unnecessary services, and installing security patches. Together these steps are part of a Defence-in-Depth approach: hardening endpoints alone is not enough; the network that ties devices together must be hardened as well.

Teaching note: Paraphrased for learning from IACS cybersecurity course material and industry practice. Not a substitute for CIS Benchmarks, DISA STIGs, vendor hardening guides, or the normative text of ISA/IEC 62443 — always use those sources for baseline settings and assessment.

Related: Defence in Depth | IEC 62443-2-1 Clause 9 – Component Security | Patch Management | 3-1 Clause 8.2 Malicious code detection | 3-1 Clause 9.1 Server/workstation OS | 3-1 Clause 8.6 Host configuration | Firewall Planning and Lifecycle | 3-1 Clause 8.3 IDS | Network Security Devices

What can be hardened

As a general rule, if a system or device is configurable, some hardening steps apply. In an IACS environment that includes:

ISA/IEC 62443-2-1 expects components to be hardened before they enter service, kept hardened through life, and for the measures to be documented (COMP 1.1).

Operating system hardening

Guidance sources

OS hardening is unglamorous but essential for keeping the attack surface down. Common guidance includes:

Common steps

Unnecessary software and services

Remove or disable items that do not belong on production IACS hosts, for example:

Managing configuration at scale

Managing hundreds of Group Policy and local security settings by hand is slow and error-prone. Organisations typically automate baselines with Active Directory Group Policy, Microsoft security compliance tooling, and/or DISA STIG-derived templates so the same hardened posture is applied consistently across fleets.

CIS Benchmarks

The Center for Internet Security (CIS) publishes configuration benchmarks — recommended controls for hardening devices, applications and networks, defined through consensus among security professionals in government, business and academia. Free PDF benchmarks are widely used; members can obtain machine-readable (for example XML) formats for integration into configuration-management systems. Many enterprises treat CIS Benchmarks as a de facto standard for IT configuration best practice.

A typical Windows benchmark provides hundreds of recommended local policy settings, each with description, rationale, audit steps, remediation, impact, default value and references. Obtain current benchmarks from the CIS website rather than copying settings from secondary sources; always validate impact on IACS availability before applying wholesale.

IACS device hardening

Industrial Automation and Control Systems include many non-Windows, cyber-physical endpoints that control or sense the process and often run embedded operating systems. Examples include PLCs, motors and drives, I/O, HMIs, sensors and analyzers, IEDs, and flow computers.

Guidance sources

Document the hardening measures applied to each device type so they can be verified and maintained for the operating life of the component (COMP 1.1).

Network hardening

Defence-in-Depth is incomplete if only endpoints are hardened. Harden the network components that connect them, including switches, routers, firewalls, gateways, wireless access points and IDS sensors.

Data, control and management planes

Network devices conceptually separate traffic into planes that often overlay the same infrastructure:

Protect and restrict the management plane in particular: separate it from process traffic where practical, and never leave administrative interfaces exposed with weak credentials or cleartext protocols. See also firewall planning and lifecycle.

Best practices

Start with the device vendor’s hardening guidance, then supplement with sources such as NSA, Cisco, SANS and NIST best practices as needed for your architecture.

Key takeaways