Linux Security

  1. System Hardening
    1. Kernel Hardening
      1. Kernel Parameter Tuning
        1. sysctl Configuration
          1. Network Stack Hardening
            1. Memory Management
              1. Process Security
              2. Kernel Module Security
                1. Module Loading Restrictions
                  1. Module Signing
                    1. Blacklisting Modules
                      1. Runtime Protection
                      2. Kernel Security Features
                        1. KASLR (Kernel Address Space Layout Randomization)
                          1. SMEP (Supervisor Mode Execution Prevention)
                            1. SMAP (Supervisor Mode Access Prevention)
                              1. Control Flow Integrity
                              2. Memory Protection
                                1. Stack Protection
                                  1. Heap Protection
                                    1. ASLR Configuration
                                      1. NX Bit Usage
                                    2. Boot Security
                                      1. Bootloader Protection
                                        1. GRUB Password Protection
                                          1. Boot Menu Security
                                            1. Kernel Parameter Protection
                                            2. Secure Boot
                                              1. UEFI Secure Boot
                                                1. Key Management
                                                  1. Certificate Validation
                                                    1. Custom Key Enrollment
                                                    2. Boot Process Integrity
                                                      1. Measured Boot
                                                        1. Trusted Boot
                                                          1. Boot Attestation
                                                        2. Service Hardening
                                                          1. Service Minimization
                                                            1. Unnecessary Service Removal
                                                              1. Service Inventory
                                                                1. Attack Surface Reduction
                                                                2. Service Configuration
                                                                  1. Secure Defaults
                                                                    1. Access Controls
                                                                      1. Resource Limits
                                                                        1. Privilege Dropping
                                                                        2. Containerization
                                                                          1. chroot Jails
                                                                            1. systemd Sandboxing
                                                                              1. Namespace Isolation
                                                                                1. Capability Restrictions
                                                                                2. Application Sandboxing
                                                                                  1. Firejail Usage
                                                                                    1. Bubblewrap Implementation
                                                                                      1. Custom Sandbox Creation
                                                                                    2. System Configuration Hardening
                                                                                      1. File System Security
                                                                                        1. Mount Options
                                                                                          1. Partition Separation
                                                                                            1. Disk Quotas
                                                                                              1. File System Permissions
                                                                                              2. Network Configuration
                                                                                                1. Interface Hardening
                                                                                                  1. Protocol Disabling
                                                                                                    1. Routing Security
                                                                                                    2. User Environment
                                                                                                      1. Shell Restrictions
                                                                                                        1. Resource Limits
                                                                                                          1. Environment Variables
                                                                                                        2. Patch Management
                                                                                                          1. Vulnerability Management
                                                                                                            1. Vulnerability Scanning
                                                                                                              1. Risk Assessment
                                                                                                                1. Patch Prioritization
                                                                                                                2. Update Mechanisms
                                                                                                                  1. Package Manager Security
                                                                                                                    1. Automated Updates
                                                                                                                      1. Update Testing
                                                                                                                        1. Rollback Procedures
                                                                                                                        2. Security Advisories
                                                                                                                          1. Vendor Notifications
                                                                                                                            1. CVE Tracking
                                                                                                                              1. Patch Verification
                                                                                                                            2. Compliance and Benchmarking
                                                                                                                              1. Security Benchmarks
                                                                                                                                1. CIS Benchmarks
                                                                                                                                  1. NIST Guidelines
                                                                                                                                    1. DISA STIGs
                                                                                                                                    2. Compliance Tools
                                                                                                                                      1. OpenSCAP
                                                                                                                                        1. Lynis
                                                                                                                                          1. Custom Assessment Scripts
                                                                                                                                          2. Continuous Compliance
                                                                                                                                            1. Automated Scanning
                                                                                                                                              1. Drift Detection
                                                                                                                                                1. Remediation Automation

                                                                                                                                            Previous

                                                                                                                                            6. System Auditing, Logging, and Monitoring

                                                                                                                                            Go to top

                                                                                                                                            Next

                                                                                                                                            8. Advanced Security Topics