Chapter 12 — Operating systems

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Mechanisms and objectives"]
  N2["12.2 Configuration baselines"]
  N3["12.3 Measuring drift"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Mechanisms and objectives"]
  N2["12.2 Configuration baselines"]
  N3["12.3 Measuring drift"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Mechanisms and objectives]
    |
    v
[12.2 Configuration baselines]
    |
    v
[12.3 Measuring drift]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) relate operating system mechanisms to control objectives; (2) define secure configuration baselines; (3) measure configuration drift.

12.1 Mechanisms and objectives

Nadia studies how operating systems manage users, permissions, processes and logs. She links each mechanism to a control objective. User accounts and permissions support least privilege. Audit logs support accountability and investigation. Update mechanisms support vulnerability management. Understanding the mechanism helps her judge whether a control claim is credible. A policy saying administrators are restricted means little unless the operating system actually enforces separate administrator accounts and records their use in logs that ordinary users cannot change. Prof. Brenner suggests checking whether ordinary users can clear the security log, since that single setting decides whether the accountability claim holds.

12.2 Configuration baselines

Ardwell needs a secure configuration baseline for its office computers and servers: which services are disabled, which settings are enforced and how updates are applied. Nadia drafts a baseline based on vendor guidance and adapts it for Ardwell's needs, recording each deviation with its reason. A baseline turns a vague requirement for secure configuration into specific, testable settings. She learns that baselines need owners and review dates like policies, because operating system versions change and old settings can become irrelevant or harmful. Recording each deviation with its reason lets a later reviewer see whether the reason still applies after an operating system upgrade.

12.3 Measuring drift

Systems drift from their baseline as administrators make changes. Nadia writes a script that compares actual settings with the baseline and reports differences. In a synthetic test of forty servers, a quarter show at least one deviation, mostly an unneeded service enabled for troubleshooting and never turned off. She learns that drift is normal and that the governance question is how quickly it is detected and corrected. Regular measurement turns the baseline from a document into a living control with an observable outcome. Ten of the forty servers deviating, mostly through troubleshooting services left on, suggests adding a removal step to the troubleshooting procedure.

Worked example

Nadia links OS mechanisms to objectives, drafts a baseline with recorded deviations and measures drift across servers.

Synthetic case. Baseline and drift figures are synthetic.

Errors and limits

Baselines lag new versions. Drift scripts miss settings they do not check.

Exercises

• EX034 — Admin claim. What makes a policy restricting administrators credible?
  Show marking criteria

  Rubric: 3 = separate admin accounts enforced and logged;; 2 = enforcement;; 1 = vague;; 0 = none.
• EX035 — Baseline deviations. How should deviations from the baseline be handled?
  Show marking criteria

  Rubric: 3 = recorded with reasons;; 2 = documented;; 1 = ignored;; 0 = none.
• EX036 — Drift question. What is the real governance question about drift?
  Show marking criteria

  Rubric: 3 = how quickly it is detected and corrected;; 2 = speed;; 1 = vague;; 0 = none.

Synthesis

Operating system knowledge makes control claims testable through baselines and drift measurement.

Continue studying — chapter 12 of 50

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →