5.1Cybersecurity for IT (hardening, updates, firewall)
The essentials in 30 seconds
- Reduce the attack surface: fewer exposed services, unnecessary software and privileged accounts means fewer doors to defend.
- Updates are the most cost-effective measure: most attacks exploit known flaws that have already been fixed, scanned at scale.
- The firewall allows only what is necessary and blocks the rest; layered with antivirus/EDR and least privilege, it forms defense in depth.
Running mini-case — Sofiane hardens a server at the Algiers SME
Sofiane, a support technician at a distribution SME in Algiers, inherits a server that exposes several services “just in case” and has never been updated. He applies the section's review: he lists the installed software and services and disables what is unnecessary, checks the update status of the OS and applications, reviews the firewall rules to allow only what is necessary, and hunts down superfluous privileged accounts. He does not rely on antivirus alone: he stacks the layers. His goal: reduce the attack surface without breaking anything, testing each change on a pilot workstation before rolling it out.
Standalone case for this section: it returns in the course, diagram, script and 48h challenge of section 5.1.
1. Reduce the attack surface
Sofiane remembers the founding principle of operational cybersecurity: reduce the attack surface. The fewer exposed services, unnecessary software, privileged accounts and open ports there are, the fewer doors to defend. Hardening means disabling what is not needed and configuring the rest securely, with restrictive defaults. On the inherited server, Sofiane therefore starts by closing, not adding.
2. Update: the most cost-effective baseline
A large share of attacks exploits known, already-fixed flaws. Applying updates (OS, software, firmware) is the most cost-effective measure: it closes doors that attackers scan at scale. Sofiane plans a controlled update cadence — with testing on a pilot scope before rollout — because an unpatched system remains an easy target, regardless of everything else.
3. Filter with the firewall
The firewall controls network traffic according to rules: Sofiane allows only what is necessary and blocks the rest. Combined with antivirus/EDR, network segmentation and least privilege, it forms defense in depth: several layers, so that a single flaw cannot compromise everything. Security stacks up; it never rests on a single measure.
🔎 Concrete example — 🔎 Concrete example — A known flaw left unpatched
Sofiane follows the fate of an internet-exposed service that was never updated:
Flaw published + patch available
→ automated scanners find it within hours
→ exploitation → intrusion
If the update had been applied → door closedReading: attackers do not “choose” their target, they scan for what is vulnerable.
Lesson: updating closes doors that other measures do not compensate for.
Section vocabulary
- Attack surface
- All the points through which a system can be attacked.
Simple example: Sofiane reduces the list by closing unnecessary services.
What it is not: adding software “just in case”, which widens it.
Reflex: fewer open doors = less to defend.
- Hardening
- Disabling what is unnecessary and configuring the rest restrictively (secure by default).
Simple example: Sofiane disables unused services on the server.
What it is not: leaving the default settings, which are often permissive.
Reflex: harden = close before adding.
- Update / patch
- Patch that fixes known flaws or bugs.
Simple example: Sofiane applies patches after a pilot test.
What it is not: postponing an already-fixed flaw indefinitely.
Reflex: patch the flaw before the attackers.
- Firewall
- Device that filters network traffic according to rules.
Simple example: Sofiane allows only the flows the business needs.
What it is not: allowing everything so as not to “block” users.
Reflex: allow only what is necessary, block the rest.
- Defense in depth
- Stacking several security layers so that one flaw is not enough.
Simple example: Antivirus/EDR + firewall + least privilege at Sofiane's.
What it is not: relying on a single measure, such as antivirus alone.
Reflex: security stacks in layers.
In practice — In practice — Review a workstation or server
- List the software and services installed on a workstation in the fleet, and identify those that are unnecessary — like Sofiane on the inherited server.
- Check the update status (OS and applications) and note those that have been lagging for weeks.
- Review the workstation's firewall rules: does every allowed flow have a clear business reason?
- Review the accounts and check that none has superfluous privileges.
Step-by-step script — harden a server like Sofiane (10 min)
1) Write the objective: reduce the attack surface of the SME's inherited server. 2) Inventory the services and software; disable what is not used. 3) Record the update status of the OS and applications, and plan the patches with a pilot test. 4) Reread the firewall rules: allow only what is necessary. 5) List the layers already in place (antivirus/EDR, segmentation, least privilege) and identify the missing one. 6) Test each change on an isolated workstation before rolling out.
Keep this script: it is the same review you will replay for every new server or workstation in the fleet.
Copy-paste template — my hardening review
Target: ___ (e.g. Sofiane's SME inherited server)
[ ] Unnecessary services/software disabled (hardening)
[ ] OS + application updates current (controlled cadence)
[ ] Firewall rules: allow ONLY what is necessary
[ ] Superfluous privileged accounts removed
[ ] Layers in place: antivirus/EDR · segmentation · least privilege
Rule: close the unnecessary, patch fast, stack the layers.An office workstation
Sofiane disables unnecessary preinstalled software and checks updates on a sales rep's workstation.
An exposed server
Sofiane closes the “just in case” services and checks the file server's firewall rules.
A network device
Sofiane applies up-to-date firmware to the switch and limits open ports to the strict minimum.
Always in layers
Sofiane stacks antivirus/EDR, segmentation and least privilege rather than relying on a single measure.
✓ Best practices
- Apply a controlled update cadence: test on a pilot before rolling out.
- Never rely on a single measure: stack the layers (defense in depth).
- Test any firewall rule in an isolated environment before pushing it to production.
✗ Common pitfalls
- Leaving services exposed “just in case”.
- Postponing updates indefinitely.
- Relying on antivirus alone as total protection.
Key takeaways
- Reduce the attack surface: fewer doors to defend.
- Updates close known flaws that are actively scanned.
- The firewall allows only what is necessary and blocks the rest.
- Security stacks in layers: that is defense in depth.
48h challenge — apply it tomorrow
Like Sofiane, review ONE workstation or server: list services and software, disable one unnecessary item, check the update status and review one firewall rule. Write in one sentence the door you just closed.
- I can explain what the attack surface and hardening are.
- I know why updates are the most cost-effective measure.
- I know how to filter with the firewall and stack the layers (defense in depth).
Frequently asked questions
Isn't antivirus enough?
No: antivirus is one layer, not total protection. An unpatched system, exposed services or overly powerful accounts remain exploitable despite it. Security rests on several complementary layers — that is defense in depth.
Won't updates break production?
The risk exists, hence testing on a pilot scope before rollout. But postponing indefinitely is more dangerous: fixed flaws are public and actively exploited. You balance with a controlled cadence and testing, not inaction.
Why are updates the most cost-effective measure?