Chapter 12 — Operating systems
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Users and permissions"]
N2["12.2 Services"]
N3["12.3 Kernel protection"]
N4["12.4 Updates"]
N5["12.5 Logs"]
N6["Least functionality"]
N7["Image contents list"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Users and permissions"]
N2["12.2 Services"]
N3["12.3 Kernel protection"]
N4["12.4 Updates"]
N5["12.5 Logs"]
N6["Least functionality"]
N7["Image contents list"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Users and permissions]
|
v
[12.2 Services]
|
v
[12.3 Kernel protection]
|
v
[12.4 Updates]
|
v
[12.5 Logs]
|
v
[Least functionality]
|
v
[Image contents list]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) explain processes, users, permissions and services; (2) describe how operating systems enforce separation; (3) identify settings that matter for public PCs.
12.1 Users and permissions
Operating systems run programs as users with permissions. A patron session should run as a standard user, not an administrator, so it cannot change system files or install system-wide software.
Mateo's design gives each session a fresh standard account that has no rights beyond its own profile. Staff use a separate account with administrator rights only when maintaining the PC, and that account is not available at the login screen during opening hours. Most of the toolbars Fernhill found had been installed for the current user only, which the nightly restore removes anyway.
12.2 Services
Background services run continuously. Unneeded services increase attack surface; NIST SP 800-123 recommends removing or disabling unnecessary services on servers, and the same principle applies to endpoints.
Mateo lists every running service on the image, finds out what each does and asks whether the public PCs need it. The worked example shows one result. Each service kept is noted with its reason in the image contents list, so a later reviewer can repeat the exercise and see whether anything has crept back.
12.3 Kernel protection
The kernel enforces separation between processes. The Linux kernel self-protection project documents techniques that make the kernel harder to misuse; Windows has comparable features in its security baselines.
Fernhill's public PCs run Windows, so Mateo uses the vendor's baseline for kernel-related settings and compares the image with it. The Linux material helps him understand why the settings matter: they make it harder for a flaw in a driver or program to give an attacker control of the kernel itself. He records which baseline version the image follows.
12.4 Updates
Operating system updates fix vulnerabilities. Public PCs must receive them even though they reset nightly, so the golden image itself must be updated.
A PC that restores to an old image every night would undo its own updates. Mateo's process therefore applies updates to the golden image each month, tests it on a lab PC and releases it in stages. Urgent fixes for actively exploited flaws can go out faster, with a shorter test. The image version on each PC is checked daily, so a PC still running last month's image stands out.
12.5 Logs
The OS records events such as logons, installations and errors, which feed monitoring.
Mateo selects a short list of events that matter to the project: restore results, attempts to install software, changes to security settings and errors from the restore agent. These are forwarded to the central store. Everything else stays on the PC, where the nightly restore clears it. Keeping the list short makes the logs useful and avoids collecting information about what patrons did during their sessions. The list is reviewed yearly.
Least functionality
CIS Controls v8 and NIST SP 800-53 Rev. 5 both describe least functionality: configure systems to provide only essential capabilities. For public PCs that means a browser, office software, a PDF viewer, the catalogue, printing and accessibility tools, and nothing else. Every removed feature is one less thing to patch and monitor.
Mateo lists every installed program on the current image and marks each as needed or not, with librarians' input.
Image contents list
The golden image's contents list records every installed program, service and setting group with its reason. When someone asks why a component exists, the list answers; when a component has no reason, it is removed.
Worked example
Mateo lists services on a sample public PC and finds a remote desktop service enabled. Nobody uses it, so it is disabled in the image.
Synthetic case. Synthetic.
Errors and limits
Disabling services without checking dependencies can break features; test each change.
Exercises
- EX034 — Patron account. Why should patrons run as standard users? Rubric: 3 = cannot change system or install system-wide; 2 = partial; 1 = vague; 0 = none.
- EX035 — Services. What does SP 800-123 recommend about services? Rubric: 3 = disable unnecessary ones; 2 = partial; 1 = vague; 0 = none.
- EX036 — Image updates. Why must the golden image be updated? Rubric: 3 = PCs reset to it nightly; 2 = partial; 1 = vague; 0 = none.
Synthesis
Standard users, minimal services and an updated image form the OS foundation.
Continue studying — chapter 12 of 50
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →