Infrastructure Hardening & Secure Deployment
Overview
Section titled “Overview”This area of the competition focuses on defensive configuration and secure development practices. You will be given systems (Linux, Windows, web servers) and code that require hardening to meet security standards.
Duration: 4 hours
Typical marks distribution:
- Linux hardening: 30-35%
- Windows/AD hardening: 30-35%
- Secure coding reviews: 20-25%
- Web server/TLS configuration: 10-15%
What You’ll Face
Section titled “What You’ll Face”Linux System Hardening
Section titled “Linux System Hardening”- Disable unnecessary services (telnet, FTP, rsh)
- Configure firewalls (UFW, iptables, firewalld)
- Harden SSH (disable root login, key-based auth, non-standard ports)
- User permission reviews (sudo configurations, file permissions)
- SELinux/AppArmor policy configuration (national/international)
Windows System Hardening
Section titled “Windows System Hardening”- Windows Firewall rule creation
- Group Policy security settings
- User account auditing and lockdown
- Service hardening (disable unnecessary services)
- Registry hardening (national/international)
Secure Coding
Section titled “Secure Coding”- Fix SQL injection vulnerabilities (parameterised queries)
- Fix XSS vulnerabilities (output encoding)
- Fix CSRF vulnerabilities (token implementation)
- Fix authentication bypasses (session handling)
- Code review for insecure crypto usage
Web Server & TLS
Section titled “Web Server & TLS”- Deploy SSL/TLS certificates
- Configure strong cipher suites
- Set up HTTPS redirects
- Security headers (HSTS, CSP, X-Frame-Options)
Competition Strategy
Section titled “Competition Strategy”Time allocation:
- Spend first 15 minutes reading all tasks
- Prioritise high-mark tasks (usually Linux/Windows hardening)
- Don’t get stuck on complex secure coding - fix obvious issues first
- Screenshot BEFORE and AFTER for all changes
Common pitfalls:
- Breaking services while hardening (test after each change)
- Not documenting changes (screenshots with timestamps)
- Spending too long on low-mark tasks
- Forgetting to restart services after configuration changes
Topics (Canonical Content)
Section titled “Topics (Canonical Content)”Content is being developed. Planned topics:
- Linux Hardening - Services, firewall, SSH, permissions, SELinux
- Windows Hardening - Firewall, Group Policy, services, registry
- Active Directory Security - GPO, user management, trust configuration
- Secure Coding Fundamentals - SQLi, XSS, CSRF, authentication
- Web Server Security - Apache/Nginx, TLS, security headers
- Data Security - Encryption at rest, secure storage
Competency by Level
Section titled “Competency by Level”| Regional | National | International |
|---|---|---|
| Disable obvious services | SELinux basic policies | Advanced SELinux troubleshooting |
| Basic UFW rules | Complex iptables chains | Custom firewall scripting |
| Disable root SSH | SSH hardening + fail2ban | SSH certificate-based auth |
| Fix basic SQLi | Fix XSS + CSRF | Fix complex auth logic bugs |
| Deploy self-signed cert | Deploy proper CA chain | Configure mutual TLS |
Practice Resources
Section titled “Practice Resources”Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.