Hardening an internet-facing lab server

The loop

1. ReviewBaseline what is running and what is exposed.
2. ReduceRemove services that are not needed and tighten configuration.
3. ScanRun a vulnerability scan against the result.
4. Remediate and repeatFix what the scan finds, then scan again.

I iterated until two findings remained on the post-hardening scan. Hardening becomes measurable when every change is followed by a fresh scan and the residual risk is understood.