◇ OpenCyber Academy
Bachelor's · Chapter 11 · English

Chapter 11 — Operating systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Operating systems

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Network stacks in the host"]
  N2["11.2 Host firewalls"]
  N3["11.3 Updates and patching"]
  N4["11.4 Least functionality"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Network stacks in the host"]
  N2["11.2 Host firewalls"]
  N3["11.3 Updates and patching"]
  N4["11.4 Least functionality"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Network stacks in the host]
    |
    v
[11.2 Host firewalls]
    |
    v
[11.3 Updates and patching]
    |
    v
[11.4 Least functionality]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain how operating systems use the network; (2) manage host firewalls; (3) apply updates.

11.1 Network stacks in the host

Every device's operating system contains a network stack that sends and receives packets, manages connections and exposes services through listening ports. A clinic laptop might listen for file sharing, remote assistance and printer discovery without anyone choosing those services. Priya learns to list listening services on her own lab machine using built-in tools, and to ask of each one whether it is needed. Services that listen on the network are entry points, so turning off unneeded ones reduces exposure without any change to the network itself.

11.2 Host firewalls

Most operating systems include a host firewall that filters traffic to and from that device. It complements network firewalls: a network firewall separates groups, while a host firewall protects a device even from others in the same group. At the clinics, enabling host firewalls on clinical carts to accept connections only from the lab results server would limit damage if another clinical device were infected. Host firewalls must be managed centrally, though, since configuring dozens of devices by hand leads to inconsistent settings that nobody can verify.

11.3 Updates and patching

Operating systems and network software receive security updates that fix vulnerabilities. Delays in applying them leave known weaknesses open, and attackers often target flaws that have had fixes available for months. Priya studies the clinics' update practice and finds laptops update automatically but clinical carts are updated only when a supplier visits. She notes that devices which cannot be updated quickly are exactly those that most need network separation, because the network becomes their main protection while patches wait. She recommends a written schedule agreed with the supplier, with remote updates where possible.

11.4 Least functionality

The principle of least functionality says a system should provide only the capabilities it needs. For a clinical cart, that might mean one application, one outbound connection to the lab results server and no file sharing or remote desktop. Removing unneeded functions reduces both the chances of a vulnerability and the work of keeping things patched. Priya connects this to Saltzer and Schroeder's classic design principles, especially economy of mechanism and least privilege, which argue that simpler systems with fewer privileges are easier to make secure.

Worked example

Priya's check of a synthetic clinical cart lists five listening services; only one is needed, and the others are recommended for removal.

Synthetic case. Device data are synthetic.

Errors and limits

Disabling a service without checking dependencies can break clinical workflows; confirm with the device owner first.

Exercises

Synthesis

Host services, firewalls and updates complement network controls and shrink each device's exposure.

Continue studying — chapter 11 of 40

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →