Hardening Policy
Secure configuration and hardening of systems and applications
Purpose
Ensure information security in cloud and on-premises environments, protecting data, ensuring confidentiality, integrity and availability, and aligning with the organization's standards.
Scope
Applies to all the organization's employees and systems in the cloud and in physical facilities.
Access and Accounts
- Only authorized employees (IT, security and management) access systems and services.
- Mandatory use of strong passwords and MFA.
- Token-based access must be rotated every 180 days.
- SSH access to servers through a bastion and IP restrictions.
Infrastructure and Servers
- Ubuntu servers updated regularly; separate volumes for the OS and data (encrypted).
- Changes subject to change management.
- Strong password policies on all systems.
- Automatic monitoring of updates and weekly patches.
Network Security
- Network segregation by trust, sensitivity and criticality.
- Use of a single VPC per environment, a WAF and a load balancer for HTTP/HTTPS.
- Segregated wireless networks; guest Wi-Fi with strict restrictions.
- Network access monitoring and control, authentication and connection encryption.
Databases and Cryptography
- Encrypted RDS databases in the designated region, daily backups, 15-day retention.
- Encryption keys managed by the cloud provider's KMS.
- AES-256 encryption in transit and at rest.
Patch and Vulnerability Management
- Monthly patch cycle.
- Regular vulnerability scanning with standard tools.
- Critical vulnerabilities addressed immediately with a documented remediation plan.
Penetration and Resilience Testing
- Annual penetration tests or after significant changes.
- Advanced threat-led testing every three years, including critical systems in production.
- Vulnerability assessments before deploying critical services.
- Findings reports and a remediation plan for critical gaps.
Data Loss Prevention (DLP)
- Identification and classification of sensitive data.
- Monitoring of channels such as email, devices and file transfers.
- Restriction of copying, pasting and uploading to external services.
- Protection of backups with encryption and access control.
Threat Intelligence
- Participation in threat and vulnerability analysis from trusted sources.
- Use of information for proactive security decisions.
Monitoring and Review
- Periodic compliance and permission audits.
- Monitoring of logs, security events and vulnerabilities.
- Annual review of the policy and adjustments according to threats or environmental changes.
- Immediate reporting of incidents to the information security team.