Security Hardening

10 Lektionen in dieser Stufe

1. Threat Modelling a Connected Device
   Identify assets, attackers and entry points before choosing defences. · Lab: Draw a data-flow diagram of your dashboard and list its top five threats.
2. Hardening SSH Beyond Key Login
   Restrict users, methods and sources and slow down guessing. · Lab: Disable passwords and root login, restrict allowed users and add automatic banning of repeat offenders.
3. Automatic Security Patching
   Apply security updates unattended without surprise breakage. · Lab: Configure unattended upgrades with a reboot window and a notification.
4. Least Privilege: Service Sandboxing in systemd
   Confine a service with filesystem, capability and system-call restrictions. · Lab: Raise a unit's systemd-analyze security score by adding protections one at a time.
5. Secrets Management Without Hard-Coded Passwords
   Store and load credentials with tight permissions and rotation. · Lab: Move tokens into systemd credentials and scan the Git history for leaked secrets.
6. TLS Certificates for Local and Public Services
   Issue, install and renew certificates for both situations. · Lab: Create a private certificate authority for local hosts and automate renewal for a public name.
7. Encrypting Data at Rest with LUKS
   Protect a data partition against theft of the device. · Lab: Encrypt a data partition and unlock it at boot with a key file on removable media.
8. Auditing Open Ports and Running Services
   Scan your own device and remove what should not be exposed. · Lab: Scan the Pi from another machine, explain every open port and close two.
9. Physical Access, USB and Boot Integrity
   Limit what an attacker with the device in hand can do. · Lab: Lock down USB boot order, disable unused interfaces and review signed-boot options for your model.
10. Detecting and Responding to an Incident
    Spot tampering and follow a contain-preserve-rebuild process. · Lab: Set up file-integrity monitoring, simulate a change and work through a response checklist.

Abschlussprojekt

A hardened, internet-reachable Pi service with a written threat model, sandboxed units, encrypted data, automatic patching and an audit report you produced by scanning it yourself.

Teile für diese Stufe

• 1 × Raspberry Pi 5 or Pi 4 set from Level 1
• 1 × Second computer on the same network for scanning
• 1 × USB flash drive for key storage and tests

In jeder Lektion legst du die passenden Teile direkt in den Warenkorb. Raspberry Pi →