The Hardening Iceberg: what you don't see can cost you dearly

When it comes to cybersecurity, many companies think of antivirus, firewall or MFA. But what about hardening?

Hardening is the art of securing a system by reducing its attack surface: disabling unnecessary functions, applying security policies, configuring the right rights, and much more.

And that's where the hardening iceberg begins.

10% visible, 90% forgotten

Let's take a standard Windows system:

  • There are over 600 configurable security parameters.
  • However, when installed, less than 10% of them are activated or used by default.
  • As a result, 90% of security functions remain dormant, such as protection against memory attacks, process partitioning, application control policies and advanced logging mechanisms.

And it's not for lack of power: Windows comes with some very advanced security tools... but they're not configured.

What we don't see...

The iceberg analogy is obvious:

  • What you see (the top): antivirus, updates, password policy.
  • What 's forgotten (the underside): service security, PowerShell restriction, registry hardening, advanced auditing, internal rebound attacks, etc.
  • What we don't see (the other side of the coin): native antivirus programs as powerful as those on the market, if properly configured.

It is precisely these blind spots that attackers exploit first.

Why is it so poorly deployed?

Hardening is technically demanding:

  • Each rule can have an unexpected side-effect (e.g. disruption of a business service).
  • It requires an excellent understanding of system dependencies.
  • It must be designed according to the actual use of the workstation or server.
  • And above all, it's tedious to maintain over time.

But not doing so is like installing an armored door without locking the lock.

What to do?

A gradual approach to compliance :

  • Quick audit of basic configurations on your workstations.
  • Detecting gaps between security standards (CIS, ANSSI, Microsoft) and your reality in the field.
  • Implement a progressive plan, adapted to your business, to reduce the attack surface through appropriate configuration hardening.
  • Monitoring compliance over time.

In a nutshell:

90% of your systems' native security is there, but asleep.