Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to harden a windows 7 PC running in a kiosk type device.

Basically the hardware on the PC only needs to make outbount HTTP requests and communicate with some peripherals over USB(COM ports).

Can someone provide an easy way to accomplish this quickly and effectively or point me to some resources with a complete list of the steps to take and ports to block

share|improve this question

migrated from Mar 16 '12 at 15:24

This question came from our site for computer enthusiasts and power users.

What do you mean by "outbound calls on 80/443"? TCP/IP connections aren't calls, and if you're saying that the computer needs to be able to make outbound HTTP connections, then they wouldn't be using ports 80 or 443. Those would be the ports the target web server is listening on, but the client would use a random port in the higher port ranges locally to make the connection. – Lèse majesté Mar 16 '12 at 13:33

Have a read of the answers on the Security Stack Exchange question on Attacking Kiosks.

Configuring your outbound firewall is a very small part of the story - to help dissuade attackers there are a much wider range of security controls you need to think about:

eg. will someone actually steal the hardware, can they plug in a USB or other device

share|improve this answer

check this out 7 Steps to Harden Windows 7 and also check the comments.

share|improve this answer

I would look at the preconfigured security policy templates that come with windows 7. The high security template is a great place to start configuring your group policies. This will allow you to restrict not only unwanted traffic but also physical ports such as your USB and any oother physical connections your device may have. Futher information can be found at the link below.

share|improve this answer

You could simply configure a firewall to block all ports except the ones you need open. It's really not that difficult. Remember to leave 80 and 443 outbound open.

share|improve this answer
LMGTFY is generally considered to be in bad taste here. – rob Mar 15 '12 at 1:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.