Hardening

What is hardening?

Hardening is the systematic reduction of the attack surface of a system, application or network component by disabling or removing everything that is not needed and configuring everything that remains according to a defined, secure configuration. Think of switching off unused services and ports, replacing default passwords, restricting permissions and keeping software up to date. The result is a documented security baseline against which you can measure deviations. In IT, hardening is a basic control; in OT, it is often the most important defence for equipment that cannot be patched for years.

Every service, port, account or function the process does not need is a potential way in for an attacker. Hardening removes those entry points.

🎯 Why is hardening needed?

Software and equipment ship from the factory optimised for ease of use, not for security. A fresh operating system starts services you will never use, a switch has a web interface with a well-known default password, and a PLC often accepts new logic without authentication from any engineering station on the network.

The CyberAv3ngers campaign at the end of 2023 showed how big that risk is. Attackers took over Unitronics Vision PLCs with an integrated HMI and put a propaganda message on the screen, including at a booster station of the water authority of Aliquippa, Pennsylvania. They needed no advanced exploit: the devices were reachable from the internet and still used the factory password “1111”. CISA added the weakness to its Known Exploited Vulnerabilities catalogue as CVE-2023-6448. Changing the default password and removing the internet connection would have prevented the attack; that is hardening in its simplest form.

Hardening also pays off in day-to-day management: every component you remove no longer needs patching, monitoring or documenting.

🧠 How does hardening work?

Hardening follows three principles that recur in every major framework:

• Least functionality - install and enable only what the system needs for its task. NIST SP 800-53 calls this control CM-7 Least Functionality; in IEC 62443-3-3 it is requirement SR 7.7.
• Secure default settings - define a baseline per system type (NIST CM-2 and CM-6, IEC 62443 SR 7.6) and make sure it survives restarts and recovery.
• Least privilege - accounts and processes get only the rights they need (Least Privilege), supported by RBAC and MFA.

Hardening works on several layers at once:

🔄 How does hardening relate to patching, segmentation and monitoring?

Hardening is one layer within Defense in Depth and does not replace other controls. The difference lies in what each one addresses:

In OT, patches often arrive months late or require a shutdown. That makes hardening relatively more important there than in IT: a disabled service cannot be attacked, not even through a zero-day.

📋 Which hardening guidelines exist?

You do not have to invent baselines yourself. The most widely used sources are:

• CIS Benchmarks - free configuration guidelines from the Center for Internet Security for operating systems, databases, network devices and cloud platforms. Each benchmark has a Level 1 profile (basic, little impact on functionality) and a Level 2 profile (stricter, for environments where security carries more weight). The CIS-CAT tool lets you assess systems automatically.
• DISA STIGs - Security Technical Implementation Guides from the Defense Information Systems Agency of the US Department of Defense. Findings carry a severity category: CAT I (direct compromise), CAT II and CAT III.
• Microsoft Security Baselines - part of the Security Compliance Toolkit, with Group Policy settings for Windows Server 2016 up to 2025 and the Policy Analyzer tool to compare existing policy against the baseline.
• NIST SP 800-70 - describes the National Checklist Program, the US library of hardening checklists, partly machine-readable through SCAP.
• Vendor hardening guides - IEC 62443-4-1 requires suppliers (requirement SG-3) to deliver security hardening guidelines with their product. For OT equipment this is often the only reliable source, because a generic baseline may void the vendor’s approval.

🏭 How do you approach hardening in an OT environment?

OT hardening calls for more caution than IT hardening, because a wrong setting can stop production. A proven approach in six steps:

1. Take inventory - start from an up-to-date asset inventory: which systems, operating systems, firmware versions, services and open ports are there?
2. Choose a baseline per system type - use the vendor’s hardening guide as the lead and supplement it with CIS or Microsoft settings where the vendor allows.
3. Test first - apply the baseline to a test system, a spare system or during a planned shutdown. Check that communication with PLCs, OPC connections and licence services keeps working.
4. Implement through change management - every change with a fallback plan and a current backup of the configuration.
5. Record and maintain - document and version-control the baseline and its exceptions in configuration management; automate where possible with Group Policy, Ansible or Microsoft Configuration Manager.
6. Check periodically - compare the actual configuration with the baseline, for example with CIS-CAT, a vulnerability scan or a penetration test.

Typical values and OT nuances. For Windows Server, CIS recommends a minimum password length of 14 characters and an account lockout after no more than 5 failed attempts. NIST SP 800-63B-4 (August 2025) requires at least 15 characters for accounts protected by a password alone and 8 characters when the password is combined with MFA. On an HMI in the control room, however, automatic account lockout can be dangerous: an operator locked out during an upset cannot intervene. In such cases IEC 62443 allows compensating countermeasures, such as physical access control to the control room and closer monitoring. Antivirus, screen locks and automatic updates are likewise deployed on OT systems only in agreement with the vendor. For legacy systems that can no longer be hardened, what remains is segmentation, a jump server for remote access and, in exceptional cases, an air gap.

🔐 Which laws and standards require hardening?

• IEC 62443 - IEC 62443-3-3 (systems) and IEC 62443-4-2 (components) contain requirements for least functionality and secure configuration settings; IEC 62443-2-4 sets requirements for integrators.
• NIS2 and the Dutch Cybersecurity Act - Article 21 of NIS2 requires, among other things, security in acquisition, development and maintenance, and basic cyber hygiene practices. The Cyberbeveiligingswet, the Dutch transposition, has applied since 15 August 2026; Article 11 of the Cybersecurity Decree explicitly requires configuration and change management.
• Cyber Resilience Act - Annex I requires manufacturers to ship products secure by default, with the option to reset to that secure state, and to limit attack surfaces including external interfaces. Reporting obligations apply from 11 September 2026 and the full regulation from 11 December 2027.
• Radio Equipment Directive - since 1 August 2025, cybersecurity requirements apply to wireless equipment, with the harmonised standard EN 18031-1 addressing default passwords among other things.
• ISO 27001 and BIO - the 2022 edition of ISO 27001 includes Annex A control 8.9 Configuration management, elaborated in ISO 27002; the BIO builds on the same controls.

Hardening alone does not make an organisation compliant, but without demonstrable baselines, compliance with these frameworks is hard to substantiate.

⚠️ What are common pitfalls with hardening?

• Harden once and forget - updates, troubleshooting services and temporary exceptions make the configuration drift away over time (configuration drift).
• Applying IT baselines blindly to OT - Level 2 settings or strict lockout rules can break DCOM, OPC Classic or licence traffic.
• Undocumented exceptions - every deviation from the baseline needs a reason, an owner and an end date.
• Leaving vendors out - maintenance contracts and warranties can depend on a vendor-approved configuration; put hardening requirements into supplier agreements.

❓ Frequently asked questions

What is the difference between hardening and patching?

Patching fixes known flaws in software by installing an update. Hardening reduces the attack surface by disabling superfluous functions and enforcing secure settings. Both are needed: hardening limits the damage from vulnerabilities that have not yet been patched.

What is a security baseline?

A security baseline is the documented minimum secure configuration for a type of system, for example all Windows servers in the OT environment. The baseline serves as the standard at installation and as the yardstick for detecting deviations later. Well-known starting points are the CIS Benchmarks, DISA STIGs and the Microsoft Security Baselines.

Can you harden PLCs and other OT equipment?

Yes, but the options are more limited than on a server. For a PLC, hardening means changing default passwords, disabling unused web servers and protocols, protecting programming access and keeping firmware current according to the vendor’s hardening guide.

Are CIS Benchmarks suitable for OT systems?

CIS Benchmarks are useful for the Windows and Linux systems in OT, such as SCADA servers, historians and engineering stations. Apply them in a test environment first and agree them with the vendor, because some settings can disrupt industrial software. For PLCs and other embedded devices, CIS Benchmarks generally do not exist.

How often should you check the hardening of systems?

No standard prescribes a fixed interval; you justify it yourself based on your risks. A common practice is an automated check every quarter plus an extra check after every major change, update or incident. In IT environments this can often run continuously through configuration management; in OT the check is usually aligned with maintenance windows.

Is hardening mandatory under NIS2 and the Cyber Resilience Act?

NIS2 and the Dutch Cyberbeveiligingswet do not use the word hardening literally, but they do require security during maintenance, configuration management and basic cyber hygiene practices, which include hardening. The Cyber Resilience Act is more explicit and obliges manufacturers to ship products with a secure default configuration and a limited attack surface.

📌 In summary

Hardening is the systematic slimming down and secure configuration of systems, so that attackers find as few entry points as possible.

It starts with an asset inventory, uses proven baselines such as the CIS Benchmarks and vendor hardening guides, and is kept current through change and configuration management. In OT, hardening matters even more because patching is slow there, but it also demands testing and coordination with the vendor. Together with segmentation, patch management and monitoring, hardening is a foundation of every secured IT or OT environment.