SESK: Stuff Everyone Should Know · sesk.info/secplus-harden-remove-unneeded-services
What does NIST say to do first about services and protocols when hardening a new server's OS?
Remove or disable every service, application and protocol the server does not need.
- Leave them all on in case they are needed later
- Remove or disable the ones that are not required ✔
- Add sample content to test each one
Why: Every running service is more attack surface to patch and watch. A minimal install with only what the job needs is easier to secure. If something cannot be removed, disable it.
Huh, didn't know that: NIST says ideally a server should be on a dedicated, single-purpose host.
My server's hardening plan: fewer services, fewer surprises, and absolutely no sample content.
Like this card?
References
Answer: Remove or disable the ones that are not required. Every running service is more attack surface to patch and watch. A minimal install with only what the job needs is easier to secure. If something cannot be removed, disable it.
- NIST SP 800-123, Guide to General Server Security nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-123.pdf
remove all services, applications, and network protocols (e.g., IPv4, IPv6) that are not required
Checked 2026-10-10. - NIST SP 800-123, Guide to General Server Security nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-123.pdf
Ideally, a server should be on a dedicated, single-purpose host.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyWhich hardening step reduces the attack surface by removing what a system does not need?Security & PrivacyWhat can an intrusion prevention system (IPS) do that a plain intrusion detection system (IDS) cannot?Security & PrivacyWhich NIST media sanitization method also leaves the media unusable for storing data afterward?
That's stuff everyone should know.