Hardening baselines & remediation
When it applies
You need the defensive counterpart: how to fix a class of bug, or how to configure a system so
the class can't occur. Pairs with every offensive skill's "why it works".
Why it works
Most vuln classes have a small set of correct, well-known mitigations. Applying the right control
at the right layer (input handling, authz at the data layer, safe defaults) removes the class,
not just the instance.
Remediation by class (the fix that actually works)
- Injection (SQLi/cmd/LDAP): parameterized queries / prepared statements; never build code
from input; least-privilege DB users.
- XSS: context-aware output encoding + a strict CSP (nonce-based, no
unsafe-inline).
- Access control (IDOR/BOLA): authorize at the object layer on every request; deny by default.
- SSRF: allowlist egress, block link-local/metadata, enforce IMDSv2, resolve+validate then pin.
- Deserialization: don't deserialize untrusted input; use data-only formats; allowlist types.
- Auth/JWT: verify signatures/alg, short expiry, rotate, MFA; secrets out of code/URLs.
- Upload: validate server-side by content, store outside webroot, random names, no exec.
- Secrets: vault/manager, scan CI, rotate on exposure.
Config baselines
- Cloud: CIS Benchmarks; scan with ScoutSuite/Prowler; enforce IMDSv2, block public buckets.
- Kubernetes:
kube-bench (CIS), least-privilege RBAC, no privileged pods, network policies.
- Hosts: CIS baselines, patch cadence, disable unused services.
How to use
For a finding, cite the specific control here in the report's remediation, and (blue-team) turn
it into a config check or a detection (→ defense-detection-sigma).
References
OWASP Cheat Sheet Series; CIS Benchmarks; cloud provider security baselines.
1---2name: defense-hardening-baseline3description: Turn offensive findings into concrete hardening — the fix side of each vuln class, plus config baselines. Load for blue-team/remediation tasks, "how do we fix/prevent", secure config review, or writing the remediation section of a report. Signals: "harden", "remediation", "secure baseline", "prevent".4---56# Hardening baselines & remediation78## When it applies9You need the defensive counterpart: how to fix a class of bug, or how to configure a system so10the class can't occur. Pairs with every offensive skill's "why it works".1112## Why it works13Most vuln classes have a small set of correct, well-known mitigations. Applying the right control14at the right layer (input handling, authz at the data layer, safe defaults) removes the class,15not just the instance.1617## Remediation by class (the fix that actually works)18- **Injection (SQLi/cmd/LDAP)**: parameterized queries / prepared statements; never build code19 from input; least-privilege DB users.20- **XSS**: context-aware output encoding + a strict CSP (nonce-based, no `unsafe-inline`).21- **Access control (IDOR/BOLA)**: authorize at the *object* layer on every request; deny by default.22- **SSRF**: allowlist egress, block link-local/metadata, enforce IMDSv2, resolve+validate then pin.23- **Deserialization**: don't deserialize untrusted input; use data-only formats; allowlist types.24- **Auth/JWT**: verify signatures/alg, short expiry, rotate, MFA; secrets out of code/URLs.25- **Upload**: validate server-side by content, store outside webroot, random names, no exec.26- **Secrets**: vault/manager, scan CI, rotate on exposure.2728## Config baselines29- Cloud: CIS Benchmarks; scan with ScoutSuite/Prowler; enforce IMDSv2, block public buckets.30- Kubernetes: `kube-bench` (CIS), least-privilege RBAC, no privileged pods, network policies.31- Hosts: CIS baselines, patch cadence, disable unused services.3233## How to use34For a finding, cite the specific control here in the report's remediation, and (blue-team) turn35it into a config check or a detection (→ `defense-detection-sigma`).3637## References38OWASP Cheat Sheet Series; CIS Benchmarks; cloud provider security baselines.
NoorQureshi