Hack the Route Start free Open app Hardening and auditing
Secure baseline and hardening
The known-good configuration a host should hold, and the work of bringing it there and keeping it there.
A secure baseline is the agreed known-good state of a host: the services it runs, the options they are set to, the permissions on sensitive files. Hardening is bringing a host to that baseline — disabling what is not needed, tightening what is (no direct root SSH login, tight file modes) — and configuration enforcement is keeping it there as changes and updates push it off, called drift. A baseline makes "secure" concrete and checkable: a SCAP benchmark is a baseline written as rules, and a scan measures how far a host has drifted from it. The baseline is also the reference a file-integrity monitor and an incident responder compare the live host against.