Lesson 7 of 9

Network Hardening

Network hardening is the process of reducing a network's attack surface by eliminating unnecessary services, enforcing least-privilege access, and applying security best practices. You will learn a systematic approach to hardening routers, switches, and servers based on CIS Benchmarks and NIST guidelines. A hardened network is significantly harder to attack even when individual vulnerabilities exist.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Apply network segmentation principles to reduce attack surface. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Understanding how attacks actually work is what makes you effective at defending against them. You cannot build strong defenses if you do not understand what attackers are trying to do and how they do it. This knowledge is the core of offensive and defensive security alike.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Network Hardening · Objective 1 of 4

VIDEO

Loading video…

Audit running services

Run 'sudo systemctl list-units --type=service --state=running' to list all active services on the system. For each service, ask whether it is required for the machine's intended purpose — a web server needs nginx or apache, but probably does not need bluetooth, avahi-daemon, or cups. Cross-reference the list against the CIS Benchmark for your OS to identify services flagged as unnecessary. Document every service you find before making any changes, so you have a baseline to compare against after hardening.

Check open ports

Run 'sudo ss -tlnp' to list all TCP listening ports with the process name that owns each socket. Compare this list against your running services — every open port should correspond to a service you intentionally want to expose. Pay special attention to ports listening on 0.0.0.0 (all interfaces) versus 127.0.0.1 (localhost only) — services bound to all interfaces are reachable from the network and represent a larger attack surface. Any port you cannot explain should be investigated before proceeding.

Disable unnecessary services

For each service you identified as unnecessary, run 'sudo systemctl stop <service>' to stop it immediately and 'sudo systemctl disable <service>' to prevent it from starting at boot. Always stop before disabling — stopping alone is temporary and the service will restart on reboot, while disabling alone leaves it running in the current session. After disabling each service, re-run 'sudo ss -tlnp' to confirm the corresponding port is no longer listening. Test that the machine's intended functionality still works after each change to catch any unexpected dependencies.

Remove unnecessary packages

Run 'sudo apt list --installed 2>/dev/null' to see installed packages, then remove those that are not needed with 'sudo apt remove --purge <package>'. After removing packages, run 'sudo apt autoremove' to clean up orphaned dependencies. Removing packages is more thorough than just disabling services — a disabled service can be re-enabled by an attacker who gains access, but a removed package requires a full reinstall. Focus on removing compilers, interpreted languages, and legacy network tools such as telnet, rsh, and rlogin.

Apply CIS Benchmark

Download the CIS Benchmark PDF for your specific OS version from cisecurity.org and work through the Level 1 recommendations systematically. Each recommendation includes a rationale, an audit command to check the current state, and a remediation command to fix it. Common Level 1 items include setting password complexity requirements, configuring SSH to disable root login, enabling automatic security updates, and setting filesystem mount options. Run the audit commands first to identify gaps, then apply remediations one at a time and re-audit to confirm each fix took effect.

Previous: VPN & Encryption Basics Next Lesson