Simply stated, device hardening is the application of configuration settings, the disabling of non-essential services, and the implementation of best practice security controls. The purpose of device hardening is to aggressively eliminate or mitigate potential threat vectors that could be used to compromise a machine.

The Center for Internet Security (CIS) publishes an extensive list of device hardening standards recommended for computer workstations and servers. Settings may vary from one device to another based on factors including the device’s operating system and it purpose (e.g., server or workstation)

Examples of hardening include the disabling of unused protocols, the removal of local administrative capabilities (e.g., disallowing the installation of software by the device’s user) and restricting the way in which physical ports can be used. (For example, if a user’s job responsibilities do not require the ability to routinely copy company data to external media, USB ports can be restricted to disallow the use of removable media, while still permitting the use of keyboards, printers, etc.