Chapter 11 — Operating systems
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Accounts and privileges"]
N2["11.2 Services"]
N3["11.3 Updates"]
N4["11.4 Kernel and self-protection"]
N5["11.5 Logs"]
N6["Linux at Bramley"]
N7["Restart planning"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Accounts and privileges"]
N2["11.2 Services"]
N3["11.3 Updates"]
N4["11.4 Kernel and self-protection"]
N5["11.5 Logs"]
N6["Linux at Bramley"]
N7["Restart planning"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Accounts and privileges]
|
v
[11.2 Services]
|
v
[11.3 Updates]
|
v
[11.4 Kernel and self-protection]
|
v
[11.5 Logs]
|
v
[Linux at Bramley]
|
v
[Restart planning]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) explain users, privileges, services and updates in Windows and Linux; (2) describe how the OS enforces separation; (3) identify hardening settings.
11.1 Accounts and privileges
Standard users cannot change system settings; administrators can. Bramley's laptops give many staff local admin rights, which baseline guidance from CIS and Microsoft recommends removing.
Aisha's baseline check later shows that 25 of 45 laptops still give their users local admin rights. With those rights, a user or a malicious program can switch off the firewall, change the screen lock or install software. Removing them makes staff ask Gareth for new software, which is why the course pairs the change with a request process.
11.2 Services
Servers run services such as file sharing and directory services. NIST SP 800-123 advises removing services a server does not need, because each one adds risk and maintenance.
Bramley's four servers each have a clear purpose: shared files, the finance system, the directory that controls sign-ins, and the old housing application. Aisha lists the services running on each server and later compares them with each server's role document. The comparison finds four unneeded services, including telnet on the file server and ftp on the old application server.
11.3 Updates
Operating systems receive monthly security updates. Updates need restarts, which staff often postpone.
At Bramley the monthly update arrives on all 45 laptops, but the restart is often postponed for days. Gareth's console shows updates as installed even when the restart is pending, which made earlier reports look better than reality. Aisha adds pending restarts as a separate count, so a laptop is counted as patched only after the restart completes. On the sample laptop in the worked example, three installed fixes stayed inactive for two weeks, which the separate pending-restart count makes visible in every report.
11.4 Kernel and self-protection
The OS kernel enforces separation between programs. The Linux kernel self-protection documentation describes techniques that make the kernel harder to misuse; Windows includes comparable protections in its security baselines.
For Bramley, kernel protections are something to keep on rather than build. Aisha checks that the Windows security baseline settings that protect the kernel are enabled on the laptops and are not disabled by old drivers. On the Linux application server she records the kernel version, because missing kernel updates are part of why that server is a concern later.
11.5 Logs
The OS records logons, installs and errors, supporting investigation.
Aisha notes which logs Bramley already keeps: Windows security logs on each server, the management server's install records, and error logs on the old application server. They are spread across machines and overwritten when full, so nobody reviews them. Collecting sign-in records centrally becomes the basis for the weekly logon review in chapter 29. Aisha notes that logs are useful only if someone reads them, so the weekly review is kept to a few flags that one officer can check in minutes.
Linux at Bramley
The old application server runs Linux. Aisha learns basic Linux concepts: users and groups, file permissions and services managed by the init system. The same principles apply as on Windows: standard users for daily work, minimal services and regular updates. Gareth relies on the contractor for this server, so Aisha documents its settings for future reference.
She also notes that the server's operating system version is approaching the end of vendor support, which will matter in chapter 31.
Restart planning
Bramley sets a weekly restart window for laptops and a monthly window for servers, communicated to staff in advance.
Applying it
Gareth records the decision and its reason in the decision log, so a future officer understands why it was made.
Worked example
Aisha checks a sample laptop's pending updates: three are installed but waiting for a restart that the user has postponed for two weeks. Until the restart, the fixes are not active.
Synthetic case. Synthetic.
Errors and limits
Installed is not the same as active; restarts matter.
Exercises
- EX031 — Admin advice. What do baselines advise about local admin? Rubric: 3 = remove; 2 = partial; 1 = vague; 0 = none.
- EX032 — SP 800-123. What does SP 800-123 advise about services? Rubric: 3 = remove unneeded; 2 = partial; 1 = vague; 0 = none.
- EX033 — Pending restart. Why were the sample laptop's fixes inactive? Rubric: 3 = restart postponed; 2 = partial; 1 = vague; 0 = none.
Synthesis
Privileges, services and restarts shape endpoint security.
Continue studying — chapter 11 of 40
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →