Device hardening

Device hardening is the process of reducing a device's vulnerabilities to make it more secure. It works by making the device offer less: every feature, program or open connection left switched on is another way in, so turning it off shrinks the attack surface — the total set of routes an attacker could try.

Applying security patches

A security patch is a small update that fixes a known weakness in an operating system or a piece of software. Patches should be applied as they are issued, because until then the flaw is public and the device stays hackable. If a photo-editing program has a bug that lets a malicious image run hidden code, the patch closes that route, reducing the risk of hacking.

Reducing what the device offers

• Closing unused firewall ports: a port is a numbered channel that traffic can pass through. If a club's booking laptop has a remote-management port open but nobody ever uses it, closing that port removes a way in.
• Removing or disabling unused software and services: a tablet in a dentist's reception may arrive with a games app and a file-sharing service that staff never touch. Each one can carry its own bugs, so uninstalling them lowers the attack surface.
• Disabling unused ports: physical sockets count too. An old label-printing PC in a garden centre still has its serial and parallel sockets switched on long after the printers they were built for were replaced, and each live socket is an entry point where an unknown device could be plugged in to copy files off the machine or install malware. Turning them off in the settings closes those entry points.
• Disabling unneeded data connections: a sports centre's scoreboard controller is updated only by plugging in a cable, so its Wi-Fi and Bluetooth stay switched off, leaving fewer wireless routes for an attacker to aim at.

Changing what comes out of the box

Many devices ship with the same default password for every unit, such as a workshop's smart camera set to admin. Anyone who knows the model can look that password up and log in, so resetting default passwords to something unique prevents system settings from being altered.