Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would you consider the following to be "basic hardening items" for network equipment and servers?

  • VLANs
  • Access Control (such as NTFS permissions)
  • Patch Management System
  • Host Firewall
  • Anti-Virus

What is the minimal protection needed to segment my internal network from the DMZ and the outside? Is having a WAF, assuming you're dealing with web applications, and default denies, with tightly confined rules, on the firewalls sufficient?

share|improve this question
up vote 2 down vote accepted

The most basic principles for making a network secure are 'defence in depth' - that is, you want to put as many things between your 'crown jewels' and potential attackers as you can - and 'minimal surface area' - that is, you expose as little as possible to attack.

To get there; your list of basics is pretty good at addressing 'defence in depth', though you may want the ability to blacklist/whitelist applications.

You should have a look at minimal surface areas - turn off admin privileges, unused services, blacklist any application running outside of c:\windows, c:\program files, etc., block executables on USB, turn off web access on machines that don't need it, etc.

Finally, the Australian DSD guide at is a very good 'checklist' for this sort of thing - start at the top and work down.

share|improve this answer
Very nice link to the OZ DSD, I'm printing some dozens of A3 copies of that, cheers! – TildalWave Feb 7 '13 at 2:20
May also be interested in (and if you're communicating to non-IT people. – Bob Watson Feb 7 '13 at 2:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.