TechKnowSurge
NIST 800-53 CM-7 CompTIA Server+ 3.2 Cisco CCNA 5.1 Cisco CCST Cybersecurity 3.3 NIST 800-53 CM-2 NIST CSF PR.PS-01 CompTIA Cloud+ 2.4
TechKnowSurge Catalog Videos Security - Equipment Hardening
VideoSecurityFree

Security - Equipment Hardening

New network equipment arrives with outdated software, default passwords, and unnecessary features enabled — all of which must be addressed before deployment. Equipment hardening covers the techniques used to reduce those vulnerabilities across every device added to a network.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When new hardware arrives from a manufacturer, it is already a security liability. Devices spend days, weeks, or even months in transit and storage before they are ever powered on, meaning the operating system, firmware, and bundled software are outdated by deployment time and may carry known, exploitable vulnerabilities. Manufacturers also ship equipment with a broad set of features enabled by default to ensure a smooth out-of-the-box experience, which leaves attack surfaces open that most organizations have no need for. Equipment hardening is the discipline of correcting these conditions before a device is connected to a production network. It applies universally — to firewalls, routers, wireless access points, switches, servers, desktops, laptops, printers, VoIP phones, IoT devices, and any other networked asset. The core hardening process includes patching all firmware, software, and operating systems to current versions; changing default passwords; disabling unused hardware, services, and ports; removing bloatware and unnecessary applications; and configuring BIOS settings — including a BIOS password and a locked boot order — to prevent physical bypass attacks. Software and firmware obtained during the process should come directly from the original equipment manufacturer whenever possible, and any third-party source must be verified as legitimate. Cryptographic hashes should be used to confirm the integrity of downloaded files before installation. Because the specific steps vary depending on the type of device being hardened, technicians should consult published documentation and vendor guidance for each equipment category. Across all of them, the goal is to bring every device up to a defined baseline — the minimum acceptable security configuration required before that device can be considered ready for deployment.

What you'll learn

What's covered

Equipment Hardening

Aligned to

NIST 800-53
CM-7 Least Functionality
CM-2 Baseline Configuration
CompTIA Server+
3.2 Given a scenario, apply server hardening methods.
Cisco CCNA
5.1 Define key security concepts
Cisco CCST Cybersecurity
3.3 Verify that endpoint systems meet security policies and standards
NIST CSF
PR.PS-01 Configuration management practices are established and applied.
CompTIA Cloud+
2.4 Summarize the importance of using configuration management and infrastructure as code (IaC).

Key terms

Equipment Hardening
The process of securing a device by reducing its attack surface through disabling unneeded features, updating software, and applying security configurations before deployment on a network.
Baseline
A documented set of minimum security standards or performance metrics used as a reference point.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Patch Management
The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Configuration Management
The process of tracking and controlling changes to hardware, software, and documentation throughout a system's lifecycle.
Endpoint
Any device that connects to a network, including computers, smartphones, tablets, and IoT devices.
Firmware
Permanent software embedded in a device's non-volatile memory that controls its hardware functions and low-level operations; it bridges the hardware and any higher-level software.

Topics

Equipment Hardening Baseline Configuration Cybersecurity Network Security Endpoint Security Default Credentials Attack Surface Reduction

Transcript

Every time I got a new piece of equipment, I felt a little like it was a present for me. Despite the fact that I knew it wasn't mine, and I knew it was part of my work to get it up and running and set up on the network — I realized all that, but it still was fun to unwrap the piece of equipment. But all equipment comes with its own set of vulnerabilities, and so we need to make sure that we harden the equipment when we're putting it on the network.

The equipment to harden

When you get a new piece of equipment, there are a few things that you need to watch out for. For instance, when it rolls off the assembly line, it's going to take days, weeks, possibly months to get to you. Maybe it sits in some sort of warehouse. It could be a long time before you actually get to it. By that point in time, the operating system, the firmware, whatever software is installed on it is already outdated and has vulnerabilities — known vulnerabilities that people can leverage out there. So there are things that we're going to want to do to remove some of those vulnerabilities, like update the software.

Another thing to watch out for is that it's going to come fully functioning with lots of features turned on, because they want you to be able to successfully put it on the rack, plug things into it, put power to it, and have it working with a minimal number of steps to actually get that thing up and running and programmed. They want you to be successful and to be less likely that you return it. So equipment essentially comes to you very insecure, and we're going to need to take steps to secure that piece of equipment, to harden that piece of equipment.

Then the question is, what are you going to harden? The answer to that is everything. It could be networking equipment such as firewalls, routers, wireless access points, wireless controllers, VoIP phones. It could be servers, end user machines, copiers, printers, the internet of things, cameras, appliances. Anything that comes to you that you're putting onto your network, you should think about how you're going to harden that piece of equipment and what steps you're going to go through.

Hardening techniques

There are a lot of different steps you can take depending on what it is that you're hardening. If it's some sort of internet of things device, or some sort of server, or some sort of switch, there's going to be a different process to harden that, so you need to look that up. But there are some generalities.

  • Disable unneeded hardware. If there's hardware installed on the machine, then you're going to disable that, or just completely uninstall it if it's something that you're not going to use. Unneeded ports, unneeded devices, unneeded functions, anything like that on a device, you need to take off.
  • Set the BIOS password on it, and set up the boot order. A lot of things will boot to other devices if you plug them in, which creates a security vulnerability. So if you put a BIOS password on there and also set the boot order to be different, then no one can plug something in and bypass your security settings.
  • Patch all the firmware and software and operating system. You're going to patch all the software on there.
  • Change default passwords.
  • Turn off any unneeded or unused services. Turn off unneeded or unused ports of those services, if it is serving some sort of service out onto your network.
  • If it comes with unnecessary software — a lot of laptops nowadays and desktops nowadays come with a lot of bloatware — remove all that software.
  • Validate any software sources and code. If you're downloading new sources, new firmware, new software, go directly to the OEM. Or if you've got to go to a third party site, make sure it's legitimate, whatever source that is. Validate the software. There are things like the hashes you can use to validate software, to make sure that it is the right software.
  • Make sure any malicious code or malicious software is removed off of the devices.

Baselines

As we're hardening our equipment, we're going to want to go through checklists. We're going to want to find online documentation of what needs to be done, and each piece of equipment is going to be different. We're going to want to raise each piece of equipment up to a certain standard. That standard is called a baseline. That's the minimum that we have to do in order to implement something in a secure way. So for each piece of equipment that we have — for instance, switches or firewalls or routers or laptops or desktops — we're going to want to have that standard baseline configuration to make sure that we implement it in a secure way.

We pretty much want to harden everything. There are some general approaches that we can take when it comes to hardening the equipment, but really it's going to take a little bit of research to find out what is the process that you should go through to harden the equipment that you're rolling out on your network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →