Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Would you consider the following to be "basic hardening items" for network equipment and servers?
What is the minimal protection needed to segment my internal network from the DMZ and the outside? Is having a WAF, assuming you're dealing with web applications, and default denies, with tightly confined rules, on the firewalls sufficient?
The most basic principles for making a network secure are 'defence in depth' - that is, you want to put as many things between your 'crown jewels' and potential attackers as you can - and 'minimal surface area' - that is, you expose as little as possible to attack.
To get there; your list of basics is pretty good at addressing 'defence in depth', though you may want the ability to blacklist/whitelist applications.
You should have a look at minimal surface areas - turn off admin privileges, unused services, blacklist any application running outside of c:\windows, c:\program files, etc., block executables on USB, turn off web access on machines that don't need it, etc.
Finally, the Australian DSD guide at http://www.dsd.gov.au/publications/Top_35_Mitigations_2012.pdf is a very good 'checklist' for this sort of thing - start at the top and work down.
