System, OS, Database Hardening Policy And Procedure¶

System, os, database hardening Policy & procedure

Version history¶

Version Number	Date	Description	Created By	Approved By
0.1	23/Apr/2024	Initial Copy	[Name] [Name]
0.2	18/Jun/2024	Approved	[Name] [Name]	[Name]
0.3	28/Aug/2026	Knowledge kernel, AI/agents, control alignment	Knowledge steward	[Name]

Purpose¶

The purpose of Hardening policy is to ensure all services/applications/ports installed are approved and known and unnecessary ones disabled, and thereby reduce known and unknown vulnerabilities to the IT infrastructure thereby protecting and securing information systems from misuse and unauthorized disclosure.

Scope¶

The System, OS, Database Hardening Policy, and Procedure applies to all IT equipment’s installed and maintained by IT Team.

Understanding¶

tecciance understands that it is imperative to treat information related to all our stakeholders, clients, end consumers, employees, and investors with utmost respect and care. There shall be a continuous follow-up of the principles of Confidentiality, Integrity, and Availability when dealing with sensitive information and shall adhere to all the legal requirements when dealing with the personal data of the end-user.
This policy governs any new device/ server is onboarded securely after disabling, customizing the devices for use within tecciance offices/Datacenter.
These guidelines are generic and are applicable to all devices, Virtual Machines, and instances that are connected tecciance corporate or Data Center network (including cloud).
Settings mentioned in this document are mandatory. Additionally, technology-specific setting might be applicable as recommended by the vendor and any compliance requirements.
This policy applies to all components of the information technology infrastructure and includes:
Computers.
Servers
Application Software
Peripherals
Routers and switches
Databases
Telephone
Systems Firewall.
All staff within the IT Department must understand and use this policy. IT staff are responsible for ensuring that the IT infrastructure is hardened and that any subsequent changes to systems do not affect the hardening of systems.

Overview¶

Hardening is the process of securing a system by reducing its surface of vulnerability. By the nature of the operation, the more functions a system performs, the larger the vulnerability surfaces.
Most systems perform a limited number of functions. It is possible to reduce the number of vectors of attack by the removal of any software, user accounts, or services that are not related and required by the planned system functions. System hardening is a vendor-specific process, as different system vendors install different elements in the default install process.
The possibility of a successful attack can be further reduced by obfuscation. By making it difficult for a potential attacker to identify the system being attacked the attack cannot easily exploit known weaknesses.

The following shall be followed as per the hardening process:

NTP¶

Setup a centralized NTP server.
Check whether all the servers have the NTP clients installed. Configure NTP to synchronize from the central NTP server.
Put up a Cron to synchronize four times a day.

User password complexity¶

Ensure all local ID Passwords meet password complexity for eight characters with at least eight characters, one individual character, and one capital letter.
Ensure settings are five unsuccessful authentication attempts lockout the user ID.
Ensure any new user ID created should be prompted to change the password on first login.

Securing user account¶

All guests must be disabled.
Default user ID must be either removed or disabled.
If an account cannot be removed or disabled, then it should be renamed.
All custom accounts must be justified and defined on a need-to-know basis.
All custom accounts must be approved before addition and deletion and proper change management procedures must be followed.

Harden SSH/ RDP¶

Set session idle timeout to 5 minutes.
Cyphers used for Remote access protocols must be in line with an acceptable encryption policy.

Antivirus installation and configuration¶

Install antivirus with a centralized setup such that each machine does not download the update files directly from the internet.
Antivirus server is configured to download the update files every day at 1 am for antivirus. Antivirus is installed in all Servers Windows and configured to get updates from the Antivirus server.
Scanning is enabled at system startup.

Patch updates¶

All devices should be upgraded to the latest available OS, Firmware
Any applications on the Servers/Desktops should be updated with the latest secure and stable version.

Perform vulnerability scan¶

The system should be scanned with a suitable vulnerability scanner. The results of the scan should be reviewed, and any issues identified should be resolved.
If there are no significant vulnerabilities the system can be prepared for live use.

Hardening process flow¶

AWS Hardening Guidelines¶

Security Checklist – General¶

Protect your root account. Protect your access keys the same way you protect your private banking access.
Protect your CloudTrail and you are Billing S3 Bucket. Limit access to users and roles on a “need-to-know” basis.
Activate region based CloudTrail. Ensure visibility and traceability of all your AWS account activities.
Create administration roles with limited privileges. Use IAM policies to limit access only to services needed.
Familiarize yourself with AWS Security Token Service (STS) and roles. AWS STS is a service that enables you to request temporary, limited-privilege credentials.
Familiarize yourself with AWS Detailed Billing and monitor your monthly usage regularly. AWS Detailed Billing provides you with a “by-the-hour” insight of resources used and costs incurred.

Security Checklist – EC2/VPC/EBS¶

Only use encrypted EBS volumes. Encrypt your data, snapshots, and disk I/O using the customary AES-256 algorithm.
Activate your VPC Flow Logs. Collect IP traffic from and to the network interfaces in your VPCs for further analysis.
Protect your EC2 Key Pairs. Follow our best practices for managing your access keys.
Leverage IAM roles for EC2. Limit access only to required resources using IAM policies and roles.
Control inbound and outbound traffic to your EC2 Instances with clearly structured Security Groups. A Security Group is a virtual, easy-to-use security system for each EC2 instance controlling inbound and outbound traffic.

Definitions & Terms¶

Sr. No	Terms/Acronyms	Description
1	OS	Operating System
2	SCCM	System Center Configuration Manager
3	LAPS	Local administrator password solution
4	BIOS	Basic Input/Output system
5	SIEM	Security Information and Event Management
6	NTP	Network Time Protocol
7	SNMP	Simple Network Management Protocol
8	SSH	Secure Shell
9	SNOW	ServiceNow

Artificial intelligence, software agents, and organizational knowledge¶

This section is added in version 0.3 so the policy applies equally to employees and to software agents, and so reusable knowledge stays provenanced.

Software agents, bots, service accounts, CI jobs, and coding assistants are identities. They are in scope of this policy wherever people are.

Every retrieve or use of organizational knowledge or classified data requires a verified identity, a stated purpose, and a classification ceiling. Missing purpose is deny.

AI may extract, draft, rank, or propose. AI shall not approve access, classify or reclassify information, set reuse rights, waive a control, merge to a protected branch, or treat search ranking as truth.

Approved reusable knowledge is a governed claim with source, owner, lifecycle, applicability, and limitations. Raw chat, tickets, and scanner output are not approved knowledge.

Embeddings, summaries, caches, and compiled agent skills are derivatives. Withdrawal, reclassification, or destruction of a source shall propagate to derivatives.

Secrets, credentials, production data dumps, and Restricted (including client/PHI) material shall not be pasted into public generative-AI services or stored in vector indexes unless an authorized path and agreement exist.

HIPAA-regulated PHI is out of default scope. Enable the HIPAA pack and a business-associate path before any PHI is processed by agents or knowledge indexes.

Change to a must procedure (including knowledge used by agents) is a change under the Change / Release procedure and SOC 2 CC8.1. Agents cannot approve that change.

Container and orchestration baselines (non-root, read-only filesystem, no privileged) apply where the tech profile includes those platforms.

Agent-framework runtimes shall have a constrained tool blast radius if a prompt injection succeeds.