Security Hardening · Secure Configuration
Service group: CybersecurityRemove the easy openings from your devices, servers and cloud tenant
Default settings favour convenience. We apply documented secure configuration baselines to your computers, servers, Microsoft 365 tenant and network equipment, test them against how your staff actually work, and keep them from drifting.
At a glance
- Service
- Design, staged rollout and maintenance of secure configuration baselines across devices, servers, cloud services and network equipment
- Best suited to
- Organizations of roughly 5 to 200 employees with inconsistent device settings or default cloud configuration
- Core inclusions
- Baseline design informed by CIS Benchmarks and Microsoft security baselines, pilot testing, staged deployment, exception records and drift checks
- Not included by default
- Application code changes, hardware replacement for unsupported systems, penetration testing and formal compliance attestation
- Pricing basis
- Fixed-fee hardening project, with optional ongoing drift management per device per month, confirmed in a written quotation
- Regions
- Delivered remotely across Canada, with on-site work in Metro Vancouver, the Fraser Valley and Calgary confirmed per address
- How to start
- Begin with a Security Assessment or Endpoint Security Assessment, then scope the hardening project
What security hardening is
Hardening means reducing the attack surface of a system by changing its configuration: turning off features and protocols you do not use, enforcing encryption, limiting who can install software or run scripts, restricting administrative access and enabling security features that ship disabled. It applies to laptops and desktops, servers, your Microsoft 365 tenant, firewalls and Wi-Fi.
We build baselines from established references, including CIS Benchmarks, Microsoft security baselines and the Canadian Centre for Cyber Security guidance, then adapt them to your applications and workflows. A baseline that breaks your accounting software or blocks a needed macro will be reversed by frustrated staff, so testing and exceptions are part of the work.
Hardening is usually a project followed by maintenance. Settings drift as devices are replaced, software is installed and troubleshooting changes are made. Ongoing drift checks keep the baseline in place.
Common configuration weaknesses
Everyone is a local administrator
Staff can install anything, and malware running as the user inherits full control of the device.
Old protocols left on
SMBv1, NTLMv1, legacy TLS versions and unused remote services remain enabled because nobody turned them off.
Unencrypted devices
Laptops without BitLocker or FileVault expose client data if lost or stolen.
Default cloud settings
Microsoft 365 allows anonymous sharing links, user app consent and external auto-forwarding by default or by past decision.
What we harden
Windows and macOS devices
Disk encryption, removal of local admin rights, Windows LAPS, attack surface reduction rules, macro restrictions, screen lock and firewall settings delivered through Intune.
Windows servers
Removal of unused roles and services, legacy protocol shutdown, restricted remote access, audit logging and administrative tiering.
Microsoft 365 tenant
Sharing defaults, external forwarding, user consent, audit logging, mailbox auditing and admin portal restrictions.
Firewalls and Wi-Fi
Removal of unused rules, closed management interfaces, current firmware, WPA3 or WPA2-Enterprise where supported and guest network separation.
Exception management
Each deviation from the baseline is recorded with its reason, owner and review date.
Drift detection
Compliance reports in Intune and periodic configuration checks flag devices that fall out of baseline.
Scope
The systems and baselines included are listed in your proposal.
Typically included
- Baseline design for in-scope device, server, tenant and network categories
- Pilot deployment to a test group with issue tracking
- Staged rollout with staff communication
- Documented exceptions with reasons and review dates
- Configuration documentation for your records
- Drift checks if ongoing management is selected
Requires separate scope or quotation
- Changes to application source code or vendor software
- Replacement of hardware or operating systems that cannot meet the baseline
- Penetration testing to validate hardening
- Compliance attestation or certification against any standard
- Hardening of systems not managed through tools we can access
Tools and references
- Microsoft Intune configuration profiles, security baselines and compliance policies
- Group Policy for on-premises Active Directory environments
- Windows LAPS, BitLocker and FileVault
- CIS Benchmarks and Microsoft security baselines
- Microsoft Secure Score for tenant configuration
- Firewall and Wi-Fi vendor management consoles
Who it suits
Organizations that grew informally
Businesses whose devices were set up one at a time over years with no common standard.
Teams moving to Intune
Organizations adopting cloud device management that want security baselines built in from the start.
Firms after an assessment
Businesses with a list of configuration findings from an assessment that need them fixed systematically.
Benefits
- Fewer ways for malware and attackers to gain control
- Consistent settings across every device and server
- Lost or stolen laptops protected by encryption
- Documented exceptions instead of unexplained differences
- Configuration evidence for clients and insurers
How a hardening project runs
Current state
We collect configuration data from devices, servers, tenant and network equipment.
Baseline proposal
We propose settings per category and flag those likely to affect users or applications.
Pilot
Baselines are applied to a test group, often in audit mode first, and issues are resolved.
Staged rollout
Settings are rolled out in waves with communication and support.
Document and maintain
Baselines and exceptions are documented and, if selected, drift checks begin.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Hardening project
A fixed-fee project for the device, server, tenant and network categories you choose.
Ongoing drift management
Per-device monthly checks and corrections to keep baselines in place.
Assessment first
A Security Assessment or Endpoint Security Assessment to decide which categories matter most.
Frequently asked questions
Will hardening break our applications?
It can if done carelessly. We pilot settings with a test group, use audit modes where available, and record exceptions for applications that genuinely need them.
Do we have to remove admin rights from everyone?
We strongly recommend it for everyday accounts. Staff who need to install software can request it, or receive a controlled elevation process.
Does hardening make us compliant with CIS?
We use CIS Benchmarks as a reference, adapted to your environment. That is different from a formal compliance assessment, which would be a separate engagement with an independent assessor.
How long does a hardening project take?
It depends on the number of systems, categories and how quickly pilot feedback arrives. We confirm the timeline in your quotation.
Related services
Products and packages
Industries we support
Service areas
Replace default settings with a documented baseline
Book a consultation to choose which systems to harden first and receive a fixed-fee proposal.