CyberSecurity Deep Dive
by Sergey Okinchuk
The OWASP Top 10 as a MapThe Host Attack Surface

Chapter Seven · Making a Foothold Reach Nothing

System and Host Hardening

The intruder has a foothold on a Meridian host. This chapter hardens the host so that foothold reaches nothing — closing the privilege-escalation paths, shrinking the OS attack surface, adding endpoint detection, and keeping software patched. It assumes basic Linux from the Linux Deep Dive and focuses on the security-relevant configuration.

5 topics

A default operating system install ships with far more running services, installed packages, and standing privilege than any single role needs — and every one of them is attack surface for someone already on the box. Hardening is the disciplined reduction of that surface plus the controls that make the remainder harder to abuse, so that the foothold from Chapter 5 lands somewhere small, loud, and stuck.

Five topics: inventorying the host attack surface, closing the privilege-escalation paths that turn a user shell into root, applying a concrete hardening baseline, adding endpoint detection and response, and running patching as a measured program. The recurring theme is minimize first, then protect what remains.

Hardening a Meridian host — minimize, then protect
1
Minimize surface
services · ports · accounts
2
Close escalation
sudo · SUID · kernel
3
Harden config
SSH · baseline · SELinux/AppArmor
4
Detect and patch
EDR · patch management

Topics in This Chapter

Topic 38
The Host Attack Surface
Every running service, open port, package, and account is host attack surface — and a default install ships far more of all of them than any role needs. Minimize first, from a documented baseline.
Attack Surface
Topic 39
Privilege Escalation
A foothold usually lands with limited privileges; the next move is to become root. Escalation exploits misconfiguration already on the host — broad sudo, SUID binaries, writable services. Find and close them first.
PrivEsc
Topic 40
Hardening a Linux Host
The concrete configuration that locks a host down: SSH done right, kernel and account settings, filesystem permissions, auditd, and a mandatory-access-control layer like SELinux or AppArmor.
Baseline
Topic 41
Endpoint Protection and EDR
Signature antivirus matches known-bad files; modern EDR watches behavior, because attackers use fileless and living-off-the-land techniques no signature catches. The sensor and responder feeding the SOC.
EDR
Topic 42
Patch and Vulnerability Management
Most breaches exploit vulnerabilities that already had a patch. Vulnerability management is the cycle of discovering what's vulnerable, prioritizing by real risk, and remediating fast — especially internet-facing.
Patching