Application hardening is the process of configuring an application to reduce its attack surface and make it more secure. The process involves several steps, including removing unnecessary features or services, enabling security features, configuring access controls, and implementing secure coding practices. By disabling unnecessary features or services, the application becomes less vulnerable to attacks that exploit these features or services. For example, an application that does not need to run as a privileged user should be configured to run with limited privileges. Additionally, disabling or removing unused or unnecessary application files and programs can help reduce the attack surface. This makes it harder for attackers to exploit vulnerabilities in the application. Penetration testing and patch management are also important components of application hardening, but they are not the primary function of the process. Reference: Section 4.2 Security Hardening and Monitoring, page 228.