CY5: Network defence and hardening
Hardening, patching and backups
🎯You'll be able to
Build servers from a secure baseline, keep them patched, and keep backups that can actually restore the service.
🏠The everyday picture
A car is safer when it leaves the factory with good brakes, gets serviced on schedule, and has a spare tyre that's actually inflated.
📘What it really is
-
Hardening: remove or disable software and accounts that aren't needed, change defaults, and follow a baseline such as the CIS Benchmarks.
-
Remote admin: SSH with keys instead of passwords, no direct root login, and access limited to a VPN or known addresses.
-
Patching: apply security updates on a schedule, faster for internet-facing systems and actively exploited flaws. Automatic security updates help for operating system packages.
-
Inventory: you can't patch what you don't know about. Keep a list of servers, software and versions.
-
Backups: the 3-2-1 rule: three copies, on two kinds of storage, one kept offline or away from the main system. Ransomware often tries to delete backups it can reach.
-
Test restores: a backup that's never been restored is a hope, not a plan.
- Denial of service: content delivery networks and providers' protection absorb large floods; rate limits protect logins and searches.
📝A worked example
Input: a new Linux server for AarogyaDesk.
Steps:
- Install only what's needed; create a personal admin account; turn off SSH password login and root login.
- Turn on automatic security updates; set a monthly patch window for everything else.
- Back up the database nightly to a second location, keep one weekly copy offline, and restore it to a test machine once a month.
Expected output: a one-page build checklist and a backup plan with a restore test.
🌍Where it's used
- Cloud images built from hardened baselines.
- Ransomware recovery: organisations with offline backups recover in days instead of weeks.
- Audits ask for patch records and restore tests.
📝Case scenario
A school's records were encrypted by ransomware, and so was its backup drive, which was always plugged in. A nearby school hit by the same group restored from a weekly offline copy in two days.
🖱️Try it
Write a five-line restore test for a backup you keep (photos, documents or a site). Success: it says where the copy is, how you'd restore it, and how you'd check it worked.
⚠️Common mistakes
- Default passwords left on. Sign: admin/admin. Fix: change or remove all defaults.
- Backups always connected. Sign: one plugged-in drive. Fix: one copy offline or isolated.
- Never testing restores. Sign: no restore date on record. Fix: test on a schedule.
🛠️For your project
The capstone notes include a hardening checklist and a backup and restore plan for AarogyaDesk.
✅Quick check
What is the 3-2-1 backup rule?
Show the answer
Three copies, on two kinds of storage, with one kept offline or elsewhere.
Why must backups be tested?
Show the answer
Only a successful restore shows that the backup works.