I'm learning that much of the security advice I come across under the "hardening" heading simply does not apply to a single-user home desktop box sitting in a private wireless IPv4 LAN behind a Comcast cable modem. Furthermore, FWIW, this system is Unix-based, and
sudo is used whenever superuser privileges are needed.
My understanding (please correct me if I'm wrong) is that such a machine is basically "invisible to the outside", and thus cannot be specifically targeted, out-of-the-blue, by some random attacker. (See https://security.stackexchange.com/a/7831/49340.)
Therefore, AFAICT, the only significant vulnerabilities for such a machine would fall into one of four broad categories:
- "physical access" (e.g. a break-in);
- insecure passwords and/or weak password management;
- vectors inadvertently downloaded by the user while browsing the web;
- remote (third-party) site vulnerabilities.
The last category above, 4, refers to the exposure to home computer A that may suddenly arise when a third-party site B, holding confidential information about A, suffers a security breach, thereby rendering A more vulnerable than it was before. There's not much that the owner of A can do to prevent this, other than avoiding giving sensitive information to insecure third-party sites (which is, of course, easier said than done).
Regarding category 1, one thing that the owner of home desktop A could do to reduce this vulnerability would be to encrypt the machine's storage media using a strong password.
As for categories 2, a decent keyring-type program should offer adequate protection. And for category 3, which is probably the most significant of all four, adopting "safe browsing habits" (including always browsing the web as an non-privileged user) is just about the only thing one can do.
I see very little "machine/OS hardening" in any of the above. (Or, to put it differently, I don't recall seeing any of the measures described above in the many articles, posts, etc. that I've read in the general category of "hardening".) The one possible exception is the business of encrypting the machine's storage.
So my question is: how applicable is "hardening" to a home setup like the one described above? Have I missed some major security areas for which "hardening", as typically understood, would be of significant benefit to such a system?
(EDIT: clarified that the system is Unix-based, and that the browsing is done always by a non-privileged user.)