Which of the following security practices is MOST effective in reducing system risk through system hardening?

System hardening is the process of securing a system by reducing its surface of vulnerability. This is most effectively achieved by minimizing the software, services, and protocols running on the system to only what is essential for its function. Enabling only the required capabilities, such as disabling unnecessary ports, services, and applications, directly reduces the number of potential attack vectors an adversary could exploit. This practice is a foundational element of building a secure system configuration and is a direct risk reduction measure.

A. This describes separation of duties, a procedural control to prevent fraud or unilateral actions, not a system hardening technique.
B. This is the principle of least privilege applied to network or resource access, which is an access control measure, not system hardening.
C. This is the principle of least privilege applied to user permissions, a crucial access control practice but distinct from hardening the system's configuration.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication 800-123: Guide to General Server Security. Section 4.1, "Initial Setup and Hardening," states, "A key part of hardening a server is to disable or remove all unnecessary services and applications."

2. Center for Internet Security (CIS). (2023). CIS Controls v8. Control 4: "Secure Configuration of Enterprise Assets and Software." This control emphasizes establishing and maintaining secure configurations, including disabling unnecessary ports, protocols, and services.

3. Purdue University. (n.d.). CS 42600: Computer Security, Lecture 15: OS Security & Hardening. Course materials discuss system hardening as the process of disabling unneeded services and securing necessary ones to reduce the attack surface.