Chapter 11 — Operating systems
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Surfaces"]
N2["11.2 Jump hosts"]
N3["11.3 Images"]
N4["11.4 Logging"]
N5["11.5 Privileges"]
N6["11.6 Hardening baselines"]
N7["11.7 Pinning versions in the image pipeline"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Surfaces"]
N2["11.2 Jump hosts"]
N3["11.3 Images"]
N4["11.4 Logging"]
N5["11.5 Privileges"]
N6["11.6 Hardening baselines"]
N7["11.7 Pinning versions in the image pipeline"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Surfaces]
|
v
[11.2 Jump hosts]
|
v
[11.3 Images]
|
v
[11.4 Logging]
|
v
[11.5 Privileges]
|
v
[11.6 Hardening baselines]
|
v
[11.7 Pinning versions in the image pipeline]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) compare admin surfaces; (2) require jump hosts; (3) treat images as in-scope when agreed.
11.1 Surfaces
Patch levels, local admins and remote services differ across Windows and Linux. Findings name OS and failed control.
On a Windows server the usual surfaces are missing cumulative updates, members of the local Administrators group and remote services such as RDP, SMB and WinRM. On Linux they are outdated packages, accounts with sudo rights and listening daemons such as SSH or an exposed database port. A finding that just says the server is insecure gives the owner nothing to act on. A finding that says a staging Linux host accepts SSH password logins from the user VLAN, contrary to the hardening baseline, names the operating system, the control that failed and what fixing it looks like.
11.2 Jump hosts
Admin paths go through jump; email-VLAN RDP to servers is a finding.
A jump host concentrates administrative access in one place that can be hardened, monitored and protected with multi-factor authentication. If administrators can also reach servers directly from the network where they read email, a phishing compromise of their workstation becomes a route to the servers that bypasses all of those controls. Sam tests the path from a synthetic user-VLAN host with an authorized account. If an RDP session to a staging server opens without passing through the jump host, the finding records the source network, the destination and the firewall rule that should have blocked it.
11.3 Images
Golden images with old agents reintroduce risk when rebuilt.
A golden image is the template from which new hosts are built, so whatever it contains is copied onto every host built from it. If the image carries an endpoint agent two versions behind, or a local account created for a debugging session, each rebuild brings that weakness back, often after the original host had been fixed by hand. Rebuilding is supposed to remove drift, but a stale image adds it instead. That is why Sam treats a weakness that reappears after a rebuild as an image problem first and checks the image's build date and contents before writing a host finding.
11.4 Logging
OS logs support detection recommendations tied to ATT&CK.
A test can show more than whether an attack works. It can also show whether the defenders would have seen it. After an authorized action, such as creating a scheduled task with a test account, Sam asks the SOC whether the Windows event for task creation arrived in the SIEM and whether any rule fired. Mapping the action to its ATT&CK technique gives both teams a shared name for it. A recommendation then reads as an improvement to detection, for example forwarding the task-creation event from staging servers and alerting when a non-administrator creates a task, rather than a vague call for more logging.
11.5 Privileges
Hypervisor admin is a separate scope layer.
Whoever administers the hypervisor controls every virtual machine on it: they can take snapshots, attach disks and open consoles without the guest operating system recording much. Permission to test the guest servers therefore does not cover the virtualisation layer, which usually has a different owner and a different risk. At TRB the virtualisation team must sign its own scope entry before anyone tests the management console. If Sam finds hypervisor credentials while testing a guest, he records that as a finding and stops there, because using them would move the test into a layer nobody authorised.
11.6 Hardening baselines
Deviations need tickets, not folklore.
A baseline is the written list of settings every host of a given type should have, such as disabled legacy protocols, a minimum password policy and audit logging turned on. Real systems deviate for real reasons, for example an old application that needs a legacy protocol. The deviation is acceptable only if it is recorded with an owner, a reason and an expiry date. Without that record, a tester cannot tell an approved exception from neglect, and the next administrator inherits a setting nobody can explain. Sam checks each deviation he finds against the exception register before deciding whether to write a finding.
11.7 Pinning versions in the image pipeline
Image pipeline tickets must name the agent versions baked in. Sam rejects "latest" as a version string. Reproducible builds of golden images are treated like application releases.
The tag latest describes a moment, not a version. An image built on Monday with the latest agent and rebuilt on Friday can contain different code, and neither ticket shows which. Exact version numbers let a tester compare a running host with the image it claims to come from, and they let the pipeline owner roll back to a known state. Treating images as releases also means each one has a changelog, a reviewer and a retirement date.
11.8 Local admin census
A quarterly query lists local admins on staging. Unexpected names become tickets. Sam correlates with leaver lists.
Local administrator rights accumulate quietly. Someone is added to fix a printer driver and never removed, or a service account is given admin rights because that was quicker than working out what it needed. The census compares each host's local Administrators group with the expected list for that host's role. Names absent from the expected list are checked against the leaver list first, because an admin account belonging to someone who has left is the most urgent case. Each census is saved, so the next one shows whether the count is falling.
11.9 Agent drift
Hosts whose agent version differs from the image catalogue by more than one minor version open tickets automatically.
The endpoint agent is how defenders see a host, so an outdated agent may miss techniques that newer versions detect, or may fail silently. The one-minor-version tolerance allows for staged rollouts, in which some hosts update a week before others, without raising tickets for normal lag. Anything further behind usually means the host stopped receiving updates, often because it was moved to a network segment the update server cannot reach. The automatic ticket names the host, both version numbers and the date the host last checked in.
11.10 A rebuild that reintroduced RDP
A rebuilt staging host comes back with an old RDP posture. The image catalogue said it should not. Sam files both a host finding and an image-pipeline finding. Two owners, two tickets, one root cause class.
The host owner can fix their server the same day by disabling RDP from the user VLAN. That does nothing for the next server built from the same pipeline. The image owner's ticket asks why the catalogue and the build disagreed. Here a configuration step had been moved into an optional stage that the rebuild skipped. Linking the two tickets lets the reviewer close the host finding only after the image finding has a fix in place.
11.11 A forgotten temporary admin
Local admin census found a dormant "temp" admin created during an outage. Ticket, remove, verify. Dormant temps are permanent until hunted.
The account had been created at 02:00 during a storage outage so that a contractor could restart services, and the incident record said it would be removed the next morning. It was not. Its password had never been changed and it had not logged in for seven months, which made it both useless and dangerous. After removing it, Sam verified the removal on the host and added a field to the outage template for emergency accounts, each with an expiry time that the closing review must check.
11.12 Copying image owners on findings
Image findings always CC the pipeline owner, not only the host owner.
Host owners often cannot see the pipeline that built their servers, and pipeline owners rarely look at individual host tickets. A weakness inherited from an image falls between the two. The host owner patches their machine and closes the ticket, and the pipeline keeps producing the same weakness. Copying the pipeline owner puts the finding in front of the person who can stop it recurring. FindingsDesk does this automatically when a finding's root cause is set to image, so the routing does not depend on the tester remembering.
11.13 Weighting image findings for recurrence
Pipeline findings use a separate severity rubric weighted toward recurrence. One bad image can mint a hundred bad hosts.
On a single host, a weak setting might rate medium because few people can reach the host. The same setting in an image that builds every staging and production web server is a different risk, because its reach grows with each build and it returns after each local fix. The image rubric therefore asks how many hosts are built from the image, how often they are rebuilt and whether any of them are internet-facing. A medium host finding can become a high pipeline finding without any change to the technical weakness.
11.14 Publishing both severity scales
Recurrence-weighted rubric for images is published beside host severity. Different beasts, different scales.
Publishing both scales prevents a predictable argument. A pipeline owner who sees a high rating for a setting the host team rated medium will suspect inconsistency unless the reason is written down. The published page shows both rubrics side by side, with a worked example of one weakness rated on each. Reviewers check that every image finding states which scale it used. Having a separate scale also lets TRB track pipeline debt on its own, which made the case for funding automated image testing.
Worked example (synthetic TRB)
Sam files staging RDP from email VLAN bypassing jump as a finding with screenshot hash.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX031 — Jump bypass. Why is email-VLAN RDP to servers a finding? Rubric: 3 = bypasses controlled jump path/logging; 2 = partial; 1 = fine; 0 = none.
- EX032 — Image risk. How do stale images create weaknesses? Rubric: 3 = redeploy old agents/settings; 2 = partial; 1 = no risk; 0 = none.
- EX033 — Hypervisor. Is hypervisor admin implied by web scope? Rubric: 3 = no; separate layer; 2 = no; 1 = yes; 0 = none.
Synthesis
OS findings name the layer; admin goes through jump hosts.
Continue studying — chapter 11 of 40
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →