awesome-security-hardening

(registration required)

and

a collection of hardening guidelines for devices, applications and OSs (mostly Apple for now)

trimstray - The Practical Linux Hardening Guide

practical step-by-step instructions for building your own hardened systems and services. Tested on CentOS 7 and RHEL 7

trimstray - Linux Hardening Checklist

most important hardening rules for GNU/Linux systems (summarized version of The Practical Linux Hardening Guide)

How To Secure A Linux Server

for a single Linux server at home

Neo23x0/auditd

Best Practice Auditd Configuration

How to secure the boot sequence of your Linux based distribution (2024)

(2019)

(2017)

(2015)

(2021) - focused on Windows 10 LTSC 2019

List of applications or files that can be used by an attacker to circumvent application whitelisting policies

NSA - AppLocker Guidance

Configuration guidance for implementing application whitelisting with AppLocker

NSA - Pass the Hash Guidance

Configuration guidance for implementing Pass-the-Hash mitigations (Archived)

NSA - BitLocker Guidance

Configuration guidance for implementing disk encryption with BitLocker

NSA - Event Forwarding Guidance

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding

work in progress

based on Jessica Payne’s talk from Ignite 2016

red teaming techniques and how to prevent them

(PDF) - very short but good summary

(Jan 2023)

ERNW - Developing an Enterprise IPv6 Security Strategy , , , - Network Isolation on the Routing Layer, Traffic Filtering in IPv6 Networks

(2009)

covers most VMware products and versions

(2018)

VMware vSphere 6.0 and 5

generic, high-level best practices for virtualization and containers (Feb 2017)

(2011)

(2018)

(2016)

for VMware 5.5 (2016), in French

(2013), in French

(2022) - see also

registration required

(2020), in French

(2023)

(2017-2018) - focused on crypto algorithms

(2015) - some algorithm recommendations might be slightly outdated

handy reference on how to configure the most common services’ crypto settings (TLS/SSL, PGP, SSH and other cryptographic tools)

update to the recommended set of key exchange methods for use in the Secure Shell (SSH) protocol to meet evolving needs for stronger security. This document updates RFC 4250

how to configure SSH to use certificates and two-factor authentication

2018, recommends TLS 1.3

2021

2017, does not cover TLS 1.3

Qualys SSL Labs - SSL and TLS Deployment Best Practices

2017, does not cover TLS 1.3

handy reference on how to configure the most common services’ crypto settings (TLS/SSL, PGP, SSH and other cryptographic tools)

/ /

(2015)

Generic recommandations but based on MDaemon Security Gateway for Email Servers

Generic recommandations but based on JSCAPE MFT Server

- 2022 (English and French versions)

2024

2012

(2011)

retrieved from web.archive.org

slides

(2017)

(2019)

(2013)

(2011)

(last draft #13 in March 2019)

a good overview of NFS security issues and some mitigations

why NFSv4 without Kerberos does not provide security

(2021, French)

recommendations for security features and configuration options applying to hardware devices (CPU, BIOS, UEFI, etc) (Nov 2019)

NSA - Hardware and Firmware Security Guidance

Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance

A free repository of customizable AWS security configurations and best practices

open-source testing framework by Chef that enables you to specify compliance, security, and other policy requirements. can run on Windows and many Linux distributions

script to check the configuration of Linux hosts

oscap command line tool

GUI for oscap

(might be outdated)

otseca

Open source security auditing tool to search and dump system configuration. It allows you to generate reports in HTML or RAW-HTML formats

SUDO_KILLER

A tool to identify sudo rules' misconfigurations and vulnerabilities within sudo

CIS Benchmarks Audit

bash script which performs tests against your CentOS system to give an indication of whether the running server may comply with the CIS v2.2.0 Benchmarks for CentOS (only CentOS 7 for now)

set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products

simple implementation of PowerShell Desired State Configuration that uses the declarative nature of DSC to scan Windows OS based systems in an environment against a defined reference MOF file and generate compliance reports as to whether systems match the desired configuration

HardeningAuditor

Scripts for comparing Microsoft Windows compliance with the Australian ASD 1709 & Office 2016 Hardening Guides

Tool to check the security of Active Directory

MDE-AuditCheck

Tool to check that Windows audit settings are properly configured in the GPO for Microsoft Defender for Endpoint

Nipper-ng

to check the configuration of network devices (does not seem to be updated)

CryptoLyzer

Fast, flexible and comprehensive server cryptographic protocol (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI

SSLyze

Fast and powerful SSL/TLS scanning library

testssl.sh

Testing TLS/SSL encryption anywhere on any port

CryptoLyzer

Fast, flexible and comprehensive server cryptographic protocol (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI

ssh-audit

SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

CHIPSEC: Platform Security Assessment Framework

framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components

chipsec-check

Tools to generate a Debian Linux distribution with chipsec to test hardware requirements

Docker Bench for Security

script that checks for dozens of common best-practices around deploying Docker containers in production, inspired by the CIS Docker Community Edition Benchmark v1.1.0

toniblyx/my-arsenal-of-aws-security-tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc

a framework to automate hardening of OS and applications, using Chef, Ansible and Puppet

Linux Server Hardener

for Debian/Ubuntu (2019)

outdated

set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products

Hardentools

for Windows individual users (not corporate environments) at risk, who might want an extra level of security at the price of some usability

Windows 10 Hardening

A collective resource of settings modifications (mostly opt-outs) that attempt to make Windows 10 as private and as secure as possible

Disassembler0 Windows 10 Initial Setup Script

PowerShell script for automation of routine tasks done after fresh installations of Windows 10 / Server 2016 / Server 2019

Automated-AD-Setup

A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening

Script to perform some hardening of Windows 10

Windows 10/11 Hardening Script by ZephrFish

PowerShell script to harden Windows 10/11

toniblyx/my-arsenal-of-aws-security-tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc

Awesome Cybersecurity Blue Team

A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams

Awesome Security

A collection of awesome software, libraries, documents, books, resources and cools stuffs about security

Android Security Awesome

A collection of android security related resources

Awesome CTF

A curated list of CTF frameworks, libraries, resources and software

Awesome Cyber Skills

A curated list of hacking environments where you can train your cyber skills legally and safely

Awesome Hacking

A curated list of awesome Hacking tutorials, tools and resources

Awesome Honeypots

An awesome list of honeypot resources

Awesome Malware Analysis

A curated list of awesome malware analysis tools and resources

Awesome PCAP Tools

A collection of tools developed by other researchers in the Computer Science area to process network traces

Awesome Pentest

A collection of awesome penetration testing resources, tools and other shiny things

Awesome Linux Containers

A curated list of awesome Linux Containers frameworks, libraries and software

Awesome Incident Response

A curated list of resources for incident response

Awesome Web Hacking

This list is for anyone wishing to learn about web application security but do not have a starting point

Awesome Threat Intelligence

A curated list of threat intelligence resources

Awesome Pentest Cheat Sheets

Collection of the cheat sheets useful for pentesting

Awesome Industrial Control System Security

A curated list of resources related to Industrial Control System (ICS) security

Awesome YARA

A curated list of awesome YARA rules, tools, and people

Awesome Threat Detection and Hunting

A curated list of awesome threat detection and hunting resources

Awesome Container Security

A curated list of awesome resources related to container building and runtime security

Awesome Crypto Papers

A curated list of cryptography papers, articles, tutorials and howtos