How it works
Hardening reduces unnecessary risk by using screen locks, approved software, secure settings, disabled unused services, and documented configuration baselines.
Pick controls that reduce routine compromise while allowing the device to do its job.
Common error
Installing one security tool does not replace patching, least privilege, backups, and secure configuration.
Worked example
Create a baseline for shared lab computers used by students.
Evidence
Current: local administrator for all users
Unused service: enabled
Screen lock: off
Approved applications: documentedProvide standard user accounts, disable unneeded services, enable suitable locking, and keep approved applications and updates managed. Test the baseline on representative hardware and required workloads before wider rollout. A baseline makes deviations visible as well as reducing exposure.
Exercises
4.1.1
Why is a baseline more useful than a one-time instruction to secure each laptop?
Show solution
It defines repeatable approved settings, supports consistent provisioning, and provides a reference for finding drift or unauthorized changes.
4.1.2
A proposed control prevents a required assistive tool from running. What should happen before broad deployment?
Show solution
Investigate the conflict in a representative test, involve the responsible owners, and find an approved configuration that preserves access while reducing risk. Document any justified exception and verification.