Secure baselines, and hardening the targets that appear on the exam

Objective 4.1 in this course covers computing resources — CompTIA's scope note for it applies secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing and monitoring. This lesson takes baselines and hardening; wireless, mobile and application security are the next lesson.

Why this matters

Domain 4 is 28% of SY0-701, the largest by a wide margin, and this is its first objective. It is also where the exam stops asking what things are and starts asking what you would do.

Hardening is the highest-return activity in security operations, because most compromises exploit something that did not need to be there: a service nobody used, a default password nobody changed, a protocol nobody had disabled. None of that requires a clever attacker.

The lesson

Establish, deploy and maintain: a baseline is a cycle, not a document

A secure baseline is the defined, approved configuration for a class of system. CompTIA splits the work into three stages and the third is the one organisations skip.

• Establish. Decide what the configuration is. Start from a recognised benchmark — CIS Benchmarks, DISA STIGs, vendor security guides — rather than inventing one, then adjust for your environment and record why each deviation exists. That record is what turns an exception into a decision.
• Deploy. Apply it — through a golden image, Group Policy, a configuration management tool, or infrastructure as code. Manual application does not scale and cannot be verified.
• Maintain. Continuously check that reality still matches the baseline, and correct it when it does not. Systems drift: people change settings to fix something, software reinstalls its defaults, and new machines get built from an old image.

The maintain stage is why configuration enforcement from Domain 2 belongs here. A baseline applied once is a snapshot of good intentions; a baseline enforced continuously is a control. If an exam scenario describes systems that were built correctly and are now inconsistent, the answer is enforcement and drift detection, not re-documenting the standard.

Baselines are also how you make an exception visible. When a system genuinely cannot meet the standard — a legacy application needing an old protocol — the deviation is recorded, approved, compensated and reviewed, which is the pattern from Domain 1.

Hardening mobile devices, workstations, switches, routers and servers

The general recipe is the same everywhere: remove what is not needed, restrict what remains, and record what happens. The specifics differ by target and CompTIA names each.

Workstations. Remove local administrator rights from users — the single highest-value change available. Apply a managed baseline, enable full-disk encryption, enable the host firewall, disable unnecessary services, enforce screen lock, restrict removable media, enable the platform's exploit protections, and turn on the logging the Domain 4.9 lesson depends on.

Servers. Minimal installation, no GUI where one is not needed, no general-purpose software, one role per server where practical. Restrict management access to an administrative network or a jump server, enforce least privilege on service accounts, and disable legacy authentication and protocols.

Switches and routers. Change default credentials. Disable unused ports and unused services (the vendor's discovery and management protocols especially). Use encrypted management — SSH not Telnet, HTTPS not HTTP. Apply port security and 802.1X. Keep management on an out-of-band network. Restrict who may administer, and log configuration changes.

Mobile devices. Enforce a passcode and device encryption, require OS updates, restrict sideloading, block rooted and jailbroken devices, and enable remote wipe. Managed through MDM, which is the next lesson.

ICS/SCADA, embedded and RTOS. Hardening is constrained by the availability and safety rules from Domain 3. The realistic set is: change defaults where possible, disable unused physical ports and services, and put the real control on the network around the device.

Cloud infrastructure. Least-privilege identity policies, no public access on storage by default, logging enabled, encryption at rest, and separation between environments.

Host-based firewalls, HIPS, disabling ports and protocols, default passwords

Four controls CompTIA names explicitly at the host level.

A host-based firewall restricts what may reach the machine and — more usefully — what it may reach. The second direction matters because it constrains lateral movement: a workstation has no legitimate reason to accept SMB or RDP connections from another workstation, and blocking that at the host closes a path the network firewall never sees, because the traffic never leaves the segment.

HIPS (host-based intrusion prevention) watches behaviour on the host and blocks what matches known-bad patterns. In current products this function is usually part of EDR, which is covered in the 4.5 lesson.

Disabling ports and protocols is the most direct form of attack surface reduction, and the exam expects a specific list of legacy protocols to be disabled in favour of encrypted equivalents: Telnet → SSH, FTP → SFTP or FTPS, HTTP → HTTPS, SNMPv1/v2c → SNMPv3, SMBv1 → disabled entirely, LDAP → LDAPS, and legacy authentication such as NTLMv1.

Default passwords are the most-exploited single condition in this objective. They persist on network appliances, printers, cameras, database installs, management consoles and IoT devices. Changing them belongs in the baseline, and verifying they were changed belongs in the maintain stage — because the deployment step is exactly where it gets missed.

Removal of unnecessary software, and proving it happened

Removing software removes its vulnerabilities permanently: an uninstalled package needs no patching, produces no alerts and cannot be exploited. That is the one control with no ongoing cost.

What to remove: bloatware shipped with the device, trial software, unused browser extensions and plugins, development tools on production servers, administrative utilities on user machines, and legacy runtimes kept for an application that was decommissioned years ago.

The proving step is the point of the heading, and it follows the same principle as the rest of the course. An engineer saying they removed something is not evidence. Evidence is:

• an inventory that lists installed software per host, from Domain 4.2's asset management;
• a configuration scan against the baseline — SCAP-based tooling automates exactly this — which reports compliance per setting per host;
• a vulnerability scan whose findings for that software disappear;
• and drift alerts when it reappears, because software that was removed once is routinely reinstalled by a user or a deployment tool.

The habit the exam rewards: when asked to verify a control, prefer the answer that measures the running systems over the one that reads a document or asks a person.

What to take into the exam

• Baseline is establish, deploy, maintain — and drift is why the third stage is the one that matters.
• Removing local admin rights from users is the highest-value workstation hardening step.
• Host firewalls restrict outbound and peer-to-peer traffic, which closes lateral movement the network firewall never sees.
• Know the legacy-to-secure swaps: Telnet→SSH, FTP→SFTP, HTTP→HTTPS, SNMPv1/2c→SNMPv3, LDAP→LDAPS, SMBv1 off.
• Uninstalled software is the only control with no ongoing cost.
• To verify hardening, measure the systems — scan and inventory — rather than reading the standard or asking the administrator.