System hardening is the disciplined process of reducing a system's attack surface by eliminating unnecessary functionality, enforcing least-privilege configurations, and applying security controls so that only the minimum required services, accounts, ports, and permissions exist. In a privacy architecture context, hardening is the technical mechanism that makes privacy controls enforceable: a system that exposes unnecessary services or retains default credentials cannot reliably protect personal data, regardless of what policies exist on paper.
Where it stops · what it isn't
- —IS: Disabling unused services, ports, and protocols; removing or disabling default and shared accounts; applying OS and application security patches; enforcing secure configuration baselines (CIS Benchmarks, NIST STIGs, vendor security baselines); configuring audit logging; enabling host-based firewalls; restricting administrative access; applying file-system and registry permissions.
- —IS: Infrastructure hardening scope includes on-premises servers, cloud instances (IaaS/PaaS), containers (Kubernetes, Docker), network devices, and databases — all components that store, process, or transmit personal data.
- —IS NOT: Hardening is not the same as vulnerability scanning. Scanning identifies gaps; hardening closes them. Hardening is also not a one-time event — configuration drift makes it a continuous discipline — and is not synonymous with patching alone (patching is one hardening activity among many).
- —IS NOT: Hardening does not replace identity and access management, encryption, or network segmentation. It works alongside them. A hardened system with weak passwords remains vulnerable.
- —IS NOT: Application-layer code hardening (secure coding practices, input validation, SAST/DAST) is a related but distinct domain. This cubelet covers OS, infrastructure, and platform hardening only.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFPrivacy Architecture — Infrastructure
REQUIRESVulnerability ManagementAsset Inventory and Classification
ENABLESAccess Control ImplementationZero Trust ArchitectureGDPR Article 32 Compliance (Security of Processing)
RELATED TONetwork SegmentationPatch Management
CONSTRAINSData Breach Probability