☰   How to use this guide

A hardening review compares a system's actual configuration against a secure baseline — CIS Benchmarks, DISA STIGs or an internal standard — and reports the gaps. It's a credentialed, mostly read-only audit: pull the config, score it against the benchmark, then verify and prioritise the high-impact deviations (default creds, weak auth, exposed services, missing logging) over cosmetic ones. This guide turns the core review areas into how-to-check, with Windows and Linux specifics.

# Benchmark scanners (pick per platform)
#  CIS-CAT Pro          -> Windows/Linux CIS scoring
#  Lynis                -> lynis audit system            (Linux)
#  OpenSCAP / oscap     -> oscap xccdf eval --profile cis ds.xml   (Linux/STIG)
#  HardeningKitty       -> Invoke-HardeningKitty -Mode Audit       (Windows)
#  Microsoft SCT / PingCastle / Nipper (devices)

0   Approach & benchmarking

Pick the right baseline for each system role and OS version, gather configs, and score against it.

Approach & benchmarking — full coverage

1   Accounts & authentication

Default/unused accounts, weak password policy, no MFA, shared admin and excessive privileges are the highest-impact config gaps.

# Windows
net accounts ; net user ; net localgroup administrators
secedit /export /cfg secpol.cfg            # review password/lockout policy
# Linux
awk -F: '($3>=1000){print}' /etc/passwd    # user accounts ; chage -l <user> for aging
grep -E 'PASS_(MAX|MIN)_DAYS|PASS_MIN_LEN' /etc/login.defs

Accounts & authentication — full coverage

2   Patch management & services

Two of the biggest attack-surface levers: missing patches and unnecessary running services/ports.

# Patch status
wmic qfe list brief                 # Windows hotfixes  (or Get-HotFix)
apt list --upgradable ; yum check-update     # Linux
# Listening services / open ports
netstat -anob   (Windows)  ;  ss -tulpn   (Linux)
systemctl list-unit-files --state=enabled    # enabled services (Linux)

Patch & services — full coverage

3   Logging & audit

Can the system evidence an incident? Audit policy on, logs sized and shipped off-box, key events captured.

# Windows audit policy
auditpol /get /category:*
# Linux auditd + log config
systemctl is-active auditd ; auditctl -l ; ls -l /var/log/{auth.log,secure}

Logging & audit — full coverage

4   Network, time, malware & encryption

Host network config (firewall on, weak protocols off), time sync, endpoint protection, and encryption at rest.

Network, time, malware & encryption — full coverage

W   Windows-specific

Windows hardening hotspots: SMB signing, NTLM/LSASS protection, UAC, PowerShell logging, ASR rules and BitLocker — mostly GPO-driven.

# SMB signing + protocol
Get-SmbServerConfiguration | select RequireSecuritySigning, EnableSMB1Protocol
# Credential protection
Get-CimInstance Win32_DeviceGuard          # Credential Guard state
# PowerShell logging + ASR
Get-MpPreference | select AttackSurfaceReductionRules_Ids
Invoke-HardeningKitty -Mode Audit          # full CIS-style audit

Windows — full coverage

L   Linux-specific

Linux hardening hotspots: SSH config, sudo, file/permission hygiene, kernel sysctl, and auditd — Lynis and OpenSCAP cover most.

lynis audit system                          # full hardening audit + score
# SSH hardening
grep -Ei '^(PermitRootLogin|PasswordAuthentication|Protocol|PermitEmptyPasswords)' /etc/ssh/sshd_config
sudo -l ; cat /etc/sudoers /etc/sudoers.d/*  # sudo misconfig / NOPASSWD
# Dangerous file perms
find / -perm -4000 -type f 2>/dev/null      # SUID ; find / -perm -2 -type f world-writable

Linux — full coverage

✓   Coverage map & how to run it

Run the universal areas on every system, then the OS-specific band. Prioritise gaps by exploitability: default creds, weak auth, exposed services and missing logging first.

Core principle: a hardening review measures the gap between the running config and a secure baseline — so anchor to a real benchmark (CIS / STIG / NIST 800-53) and map every finding to a control. Automated scanners give breadth (CIS-CAT, Lynis, OpenSCAP, HardeningKitty); your job is to prioritise the deviations that actually move risk and recommend enforcement via golden images / config management so the hardening doesn't drift back. Tick a box only when you've verified it.