Device Hardening

Status: DRAFT

Production baseline checklist

• no shared default password
• SSH disabled or key-only with controlled support access
• no unnecessary listening services
• host firewall enabled
• unnecessary kernel modules/services disabled where practical
• application runs with least privilege
• filesystem permissions reviewed
• secrets unreadable by non-required users
• debug interfaces disabled/restricted
• serial console policy documented
• writable filesystem surface minimized
• watchdog enabled
• logs have bounded storage

Recommended future hardening

• read-only root filesystem where practical
• separate writable data partition
• secure element for device keys
• hardware platform with stronger measured/secure boot capabilities for later revisions