D3fend Harden

D3FEND — Harden

When to Use

• Implementing authentication controls (MFA, certificates, biometrics, tokens)
• Hardening applications and platforms (configuration, patches, encryption)
• Managing credential lifecycle (rotation, pinning, scrubbing, policies)
• Validating input and enforcing domain/operational logic
• Securing source code (memory safety, pointer validation, dead code elimination)
• Reviewing boot integrity, driver signing, and firmware protections

When NOT to Use

• Detection engineering or monitoring → d3fend-detect
• Network segmentation or access mediation → d3fend-isolate
• Decoy and deception operations → d3fend-deceive
• Incident response or eviction → d3fend-evict
• Secure coding deep dives → devsecops / senior-software-engineer

Core Workflows

1. Authentication Hardening

See `references/authentication.md`

2. Application & Platform Hardening

• Application config hardening (disable unused features, remote access)
• Control flow integrity (CFI, stack canaries, ASLR, pointer auth)
• Bootloader authentication, TPM boot integrity
• Disk/file encryption, hardware write protection
• Software update management, driver load integrity

See `references/application_platform.md`

3. Credential & Message Hardening

• Credential rotation (certs, passwords, tokens)
• Certificate pinning (mobile, embedded)
• Message authentication (HMAC, MAC) and encryption
• Token binding to prevent session hijacking

See `references/credential_message.md`

4. Source Code Hardening

• Input validation (range, type, pointer, null checks)
• Memory safety (initialization, nullification, bounds)
• Use trusted libraries, eliminate dead code
• Exception handler validation, domain logic checks

See `references/source_code.md`

When to load references

• Authentication → references/authentication.md
• Application & platform → references/application_platform.md
• Credential & message → references/credential_message.md
• Source code → references/source_code.md

Application & Platform Hardening

Technique Coverage

Implementation

Memory Protection

Boot Integrity

Power On → BIOS/UEFI → Bootloader → OS
     ↓          ↓           ↓         ↓
   TPM PCR   Measured    Verified  Checked
   extends   extends     boot      against
   values    values      chain     expected

Patch Management

Encryption

Authentication Hardening

Technique Coverage

Implementation Guide

Multi-factor Authentication

Deployment:

• Enforce MFA for all privileged accounts
• Prefer TOTP/WebAuthn over SMS
• Require hardware keys for admin/root

Certificate-based Authentication

Client → presents client cert → Server verifies against CA
Server → presents server cert → Client verifies (mTLS)

• Maintain private CA or use public PKI
• Short certificate lifetimes (90 days)
• Automated rotation
• CRL or OCSP for revocation

Password Policy

Minimum length: 16 characters
Complexity: not required (length > complexity)
Breach check: against HaveIBeenPwned
Rotation: only on compromise, not periodic
Storage: Argon2id, bcrypt, or scrypt

Token Security

Credential & Message Hardening

Technique Coverage

Credential Lifecycle

Rotation Schedule

Certificate Pinning

Mobile app → embed expected cert hash
If server presents different cert → reject connection
Fallback: allow user override with warning

Message Integrity

Token Binding

Token issued to specific device/browser
Bound via Channel ID or TLS channel
Stolen token cannot be used on different device

Source Code Hardening

Technique Coverage

Secure Coding Checklist

Input Validation

# Good: validate range, type, and format
def process_age(age_str):
    try:
        age = int(age_str)
        if not (0 <= age <= 150):
            raise ValueError("Invalid age range")
        return age
    except ValueError:
        raise ValueError("Age must be a valid integer")

# Bad: trust input
def process_age_bad(age_str):
    return int(age_str)  # May crash or accept invalid

Memory Safety

Secrets Management

❌ Hardcoded: API_KEY = "sk-abc123"
✅ Environment: API_KEY = os.environ["API_KEY"]
✅ Secret vault: API_KEY = vault.get("api_key")

Static Analysis Integration

Pre-commit Checks

# Block commits with secrets
gitleaks protect --staged

# Block commits with high-severity issues
semgrep --error --config=auto