Security

Security Hardening Complete Guide

Master defensive security hardening with system protection, application security, network hardening, container security, and compliance best practices.

What you'll learn

Apply OS hardening checklists for Linux and Windows
Secure web applications against OWASP Top 10 attacks
Harden container images and Kubernetes deployments
Implement defence-in-depth network architecture
Set up continuous compliance scanning
Build a security monitoring pipeline

OS Hardening

Bash

1# Ubuntu 24.04 CIS Level 1 quick-wins
2sudo apt install -y aide           # file integrity monitoring
3sudo aideinit && sudo aide --check
4
5# Password policy
6sudo apt install -y libpam-pwquality
7# /etc/security/pwquality.conf
8minlen = 14
9dcredit = -1
10ucredit = -1
11lcredit = -1
12ocredit = -1
13maxrepeat = 3
14
15# Account lockout
16# /etc/pam.d/common-auth
17auth required pam_faillock.so preauth audit deny=5 unlock_time=900
18auth required pam_faillock.so authfail audit deny=5 unlock_time=900

Application Security

JavaScript

1// OWASP Top 10 mitigations (Node.js/Express)
2
3// A01 Broken Access Control — enforce server-side
4app.get('/admin', requireRole('admin'), handler);
5
6// A02 Cryptographic Failures — use strong algorithms
7import { scrypt, randomBytes } from 'crypto';
8// Never use MD5/SHA1 for passwords — use bcrypt/argon2
9
10// A03 Injection — parameterised queries only
11// NEVER: db.query(`SELECT * FROM users WHERE id = ${id}`)
12// ALWAYS:
13await db.query('SELECT * FROM users WHERE id = $1', [id]);
14
15// A05 Security Misconfiguration — security headers
16import helmet from 'helmet';
17app.use(helmet());
18
19// A07 Auth Failures — rate limit login
20import rateLimit from 'express-rate-limit';
21app.use('/auth/login', rateLimit({ windowMs: 15*60*1000, max: 10 }));
22
23// A09 Logging — structured logs without secrets
24logger.info('User login', { userId, ip, userAgent });
25// NEVER log passwords, tokens, or PII

Network Hardening

Segment networks with VLANs or VPCs — separate public, app, and database tiers
Default-deny firewall rules — only open ports explicitly required
Use a WAF (Cloudflare, AWS WAF) in front of public-facing applications
Enable TLS 1.3 only — disable TLS 1.0 and 1.1
Use private subnets for databases — never expose DB ports to the internet
Enable VPN or bastion host for administrative access

Container Security

DOCKERFILE

1# Dockerfile security checklist
2FROM node:20-alpine                    # minimal base
3RUN addgroup -S app && adduser -S app -G app
4WORKDIR /app
5COPY --chown=app:app . .
6USER app                               # non-root
7EXPOSE 3000
8# No secrets in image — use runtime env vars
9
10# Kubernetes pod security
11securityContext:
12  runAsNonRoot: true
13  runAsUser: 1000
14  allowPrivilegeEscalation: false
15  readOnlyRootFilesystem: true
16  capabilities:
17    drop: [ALL]
18
19# Scan image for CVEs
20trivy image --severity HIGH,CRITICAL myapp:latest

Compliance Scanning

Bash

1# Lynis — CIS Benchmark compliance score
2sudo lynis audit system --pentest --score
3
4# OpenSCAP — automated SCAP audit
5sudo apt install -y openscap-scanner scap-security-guide
6oscap xccdf eval   --profile xccdf_org.ssgproject.content_profile_cis_level1_server   --results /tmp/scap-results.xml   /usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml
7
8# npm audit in CI
9npm audit --audit-level=high
10# Fail build if HIGH/CRITICAL vulnerabilities found

Security Monitoring

Bash

1# Install Wazuh agent (SIEM/IDS)
2curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.0-1_amd64.deb
3sudo dpkg -i wazuh-agent.deb
4sudo systemctl enable --now wazuh-agent
5
6# Alerts to configure:
7# - SSH brute force (>5 failures in 30s)
8# - Privilege escalation (sudo from unexpected user)
9# - File integrity changes in /etc, /bin, /usr/bin
10# - Outbound connections to uncommon ports
11# - Large data transfers (potential exfiltration)