标题： 从偏执到合规：Stack Exchange 上系统加固实践的曲折道路 显示英文标题

标题： From Paranoia to Compliance: The Bumpy Road of System Hardening Practices on Stack Exchange

摘要： 强化计算机系统以抵御网络攻击对于安全至关重要。 然而，过去的事件表明，许多系统操作员在有效的系统加固方面存在困难。 因此，许多计算机系统和应用程序仍然不安全。 到目前为止，研究界缺乏对系统操作员在系统加固方面的动机、实践和挑战的深入了解。 我们重点关注实践和挑战，对316篇与系统加固相关的Stack Exchange（SE）帖子进行了定性分析。 我们发现，访问控制和部署相关的问题是最具挑战性的，系统操作员存在误解和不切实际的期望。 大多数帖子集中在操作系统和服务器应用程序上。 系统操作员受到其系统遭到攻击的恐惧或合规原因的驱动。 最后，我们讨论了我们的研究问题，对未来系统加固提出了建议，并说明了我们工作的意义。 显示英文摘要

摘要： Hardening computer systems against cyberattacks is crucial for security. However, past incidents illustrated, that many system operators struggle with effective system hardening. Hence, many computer systems and applications remain insecure. So far, the research community lacks an in-depth understanding of system operators motivation, practices, and challenges around system hardening. With a focus on practices and challenges, we qualitatively analyzed 316 Stack Exchange (SE) posts related to system hardening. We find that access control and deployment-related issues are the most challenging, and system operators suffer from misconceptions and unrealistic expectations. Most frequently, posts focused on operating systems and server applications. System operators were driven by the fear of their systems getting attacked or by compliance reasons. Finally, we discuss our research questions, make recommendations for future system hardening, and illustrate the implications of our work.