Server hardening is the process of enhancing the security of a server operating system through a variety of controls and technical configuration settings which results in a more secure server operating environment. Over the past few years I have been involved in various deployments that required a wide range of security and vulnerability management controls to be implemented. More recently I have been involved with defining some of the controls for a set of cloud applications.

Coupled with the work we have been doing on cloud operating system deployment and the security controls associated with such implementations I through I would share a list of some of the top server hardening resources (that includes security guidance, advise and standards) to be found on the web from various government, military and standards bodies.

The list below has been broken down into categories according to operating system and functional components. The list is however to a large extent make up of sources from SANS, the Center for Internet Security (CIS), the NSA, CIA, NIST, DISA and specific product vendors.

 

Main information repositories:

• SANS Checklists and Step-by-Step Guides
• SANS Critical Security Controls (SANS 20)
• NSA Security Harding Guides
• Security Technical Implementation Guides (STIGs)
• NIST National Checklist Repository

 

Vulnerability databases:

• NIST National Vulnerability Database
• Open Source Vulnerability Database
• CVE Details
• CVE Mitre
• Repository of Security Incidents (IIT and Scada Focused)

 

Operating Systems:

• Windows:
  • CIS Security Benchmarks for Windows
  • NSA Security Configuration Guides for Windows
• Microsoft Security Tools:
  • Microsoft Security Compliance Manager
  • Microsoft Baseline Security Analyzer
  • Microsoft PC Security
•  Linux:
  • CIS Security Benchmarks for Linux
  • NSA Security Configuration Guides for Linux
  • Ubuntu Security Resource
  • Debian Security
•  Mac OS:
  • CIS Security Benchmarks for Mac OS X
  • NSA Security Configuration Guides for Apple Mac
  • Mac OS X Security Configuration Guides
  • SecureMac
•  Mobile:
  • CIS Security Benchmarks for Google Android
  • CIS Security Benchmarks for Apple iOS
  • iOS Security [PDF]
  • iPad Security [PDF]
  • Mobile Device Security (from University of Notre Dame OIT Help)
• Other Unix:
  • CIS Security Benchmarks for Unix
  • NSA Security Configuration Guides for Sun Solaris
  • FreeBSD Security and Hardening Guide

 

Server Components

• Hypervisor
  • VMWare Security Guides
  • Microsoft Guidance is included in the Microsoft Security Compliance Manager and Windows Server

• Database Servers:
  • CIS Security Benchmarks for Databases
  • NSA Security Configuration Guides for Database Servers
  • Database Hardening Guidelines
•  Web Servers:
  • CIS Security Benchmarks for Web Servers
  • Securing PHP

• Home Networks:
  • NSA Best Practices for Home Networks

 

---