Building the walls of the castle
We harden the systems you already have, or build their security from the ground up: endpoints, servers, network devices and the monitoring that tells you when something changes.
Overview
What hardening actually means
Most systems ship configured to be easy to set up, not hard to break into. Default accounts, open services, permissive rules and logging that nobody reads are where many intrusions start. Hardening is the patient work of closing them, one setting at a time, without breaking what the business depends on.
Black Fox works on both sides of it. On paper: secure configuration baselines, procedures and policies that say how each kind of system should be built. On the machines: the configuration of network devices, endpoints, servers and applications, checked against that baseline.
We also set up infrastructure monitoring, so that a configuration that drifts or a service that appears overnight is noticed. And because people are part of the perimeter, we offer personal security hardening for executives and other people who are likely targets.
Who it is for
Organisations rolling out new infrastructure, teams whose systems grew faster than their standards, and anyone who received audit or penetration test findings about configuration. Personal security is for executives, founders and other people whose accounts and devices are worth more to an attacker than most.
The work, from scoping to evidence.
What we do
Endpoint hardening
Workstations and laptops configured to a baseline: local privileges, disk encryption, update policy, application control and browser settings, among others.
Server hardening
Operating systems and services reduced to what they need, with secure defaults, access controls and logging that is worth keeping.
Network hardening
Firewalls, switches, routers and wireless reviewed and tightened: segmentation, management access, unused services and rule sets that grew over the years.
Secure configuration baselines
Written baselines per system type, based on recognised references such as the CIS Benchmarks and adapted to how you actually work.
Infrastructure monitoring
Monitoring and log collection set up so that changes, failures and suspicious activity reach someone who can act on them.
Personal security
For executives and other exposed people: their devices, accounts, home network and public footprint reviewed and tightened.
How the engagement runs
Kickoff
We agree which systems are in scope, who owns them and when changes may be made, and sign an NDA first if you need one.
Current state review
We review configurations against the baseline you choose and record every deviation with its risk.
Hardening plan
A prioritised list of changes, with the expected impact on users and services, agreed with your owners before anything is touched.
Implementation
We make the changes with your teams, or guide them through it, in stages and with a rollback path for each.
Verification and handover
We check that the changes hold and hand over the baselines, the evidence and a technical report so your teams can keep them in place.
What you receive
- Configuration review report with deviations ranked by risk
- Secure configuration baselines per system type
- Hardening plan with impact notes and rollback steps
- Changes applied or guided, with evidence
- Monitoring and alerting setup, documented
- Personal security review and recommendations, where in scope
Questions
Will hardening break our systems?
Any change can. That is why we review before we change, agree each step with the owner, stage the rollout and keep a way back. Some settings are a trade-off between security and convenience; we explain them and you decide.
Which baseline do you use?
Usually a recognised reference such as the CIS Benchmarks or vendor security guidance, adapted to your environment and your framework obligations. If you already have a baseline, we start from yours.
Do you need administrative access?
To make changes, yes, under access you grant and can revoke. For a review only, read access or configuration exports are often enough.
What does personal security cover?
We look at the person's devices, accounts and authentication, their home network and what can be found about them publicly, and help them close what is open. It is done discreetly and under NDA.
Related services
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Governance and riskCIS ControlsCIS Controls assessment and implementation by Black Fox Security: pick your implementation group, measure each safeguard and fix the ones that matter first.
Start with a configuration review
Tell us which systems worry you most. We will tell you how far they are from a hardened baseline and what to change first.