Keep It or Cut It? — TechKnowSurge

About this interactive

Least functionality is configuring a system with only the essential capabilities for its job. It sits beside minimizing the attack surface and keeping things simple: anything installed is something to patch, and anything running is something to attack. The lesson's case is a LAMP web server, Linux, Apache, MySQL and PHP, that is easy to keep patched until someone adds a cheap extra called "function 123". Its developer stops updating it, it only works with old versions of Apache, MySQL and PHP, and the server is compromised through services that are out of date because of a feature nobody needed. The test for each piece of software is the system's job. A web server needs its web server; it does not need an FTP service left over from the build. A domain controller needs DNS for its clients; it does not need a print spooler with no printers. Keep what the job uses, and remove or disable the rest.

What you'll learn

Decide, for a system with a stated job, whether a service, feature or program is essential to that job or should be removed or disabled under the principle of least functionality
Explain how an unneeded function widens the attack surface, including the lesson's case of an add-on that holds a server on outdated versions of its web server, database and PHP

Aligned to

CompTIA Security+

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

3.1 Compare and contrast security implications of different architecture models.

Key terms

Least Functionality: A security principle that requires systems to be configured with only the essential capabilities needed to perform their intended function, reducing exposure to potential threats.
Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Hardening: The process of securing a system by reducing its attack surface — disabling unnecessary services, applying configuration best practices, removing default credentials, and keeping software patched. Hardened systems offer fewer opportunities for exploitation.
Server Hardening: The process of securing a server by applying proper configurations, installing security software, and performing ongoing maintenance and monitoring to reduce its attack surface.
KISS: An acronym for 'Keep It Simple, Stupid'; a security guideline that discourages unnecessary complexity in system and network design.

Topics

Least Functionality Hardening Attack Surface Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →