Chapter 3 — Operating systems and identities

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Hardening hosts"]
  N2["3.2 Accounts and least privilege"]
  N3["3.3 Administrator access"]
  N4["3.4 Multi-factor authentication"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Hardening hosts"]
  N2["3.2 Accounts and least privilege"]
  N3["3.3 Administrator access"]
  N4["3.4 Multi-factor authentication"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Hardening hosts]
    |
    v
[3.2 Accounts and least privilege]
    |
    v
[3.3 Administrator access]
    |
    v
[3.4 Multi-factor authentication]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) harden hosts; (2) manage accounts and administrator access; (3) use multi-factor authentication.

3.1 Hardening hosts

Every laptop and server runs an operating system that can be made safer. Hardening means installing updates promptly, turning off unneeded services, enabling the host firewall and using disk encryption on laptops that leave the office. Field officers' laptops are especially important because they travel and connect to home and public networks. Amina checks a synthetic laptop build and finds file sharing enabled and the host firewall off. Turning these off and on respectively is a quick hardening step that reduces risk wherever the laptop is used.

3.2 Accounts and least privilege

Each person should have their own account with only the access they need. At Castleford, field officers need the housing system and email; finance staff need the finance system; Rosa needs administrator rights. Amina finds that several staff have local administrator rights on their laptops, granted to install a printer years ago. She recommends removing them and using a support process for installations instead. Least privilege limits how far a mistake or malware can spread from one account or device.

3.3 Administrator access

Administrator accounts can change systems and the network, so they need extra protection. Amina recommends that Rosa uses a separate administrator account for administrative tasks only, never for email or browsing, and that all administrator logins require a second factor. Administrator activity is logged centrally. A shared "admin" account used by the support company is replaced with named accounts for each engineer, so that logs show who did what and access can be removed individually when people leave. Leavers' accounts are disabled on their last day.

3.4 Multi-factor authentication

Passwords alone are easily stolen by phishing. Multi-factor authentication adds something the user has, such as an authenticator app, so a stolen password is not enough. Amina helps plan multi-factor authentication for email, the VPN and administrator accounts, starting with administrators and field officers, who are most exposed. She prepares a short guide for staff and a process for lost phones. Clear support arrangements matter, because people locked out of their accounts will look for workarounds if help is slow.

Worked example

Hardening the laptop build turns off file sharing, enables the host firewall and removes local administrator rights.

Synthetic case. Builds and accounts are synthetic.

Errors and limits

Shared administrator accounts make logs meaningless and leavers hard to remove.

Exercises

• EX009 — Field laptop risk. Why are field officers' laptops a priority for hardening?
  Show marking criteria

  Rubric: 3 = travel, connect to untrusted networks;; 2 = travel;; 1 = expensive;; 0 = none.
• EX010 — Local admin removal. Why remove local administrator rights from staff?
  Show marking criteria

  Rubric: 3 = limits spread of mistakes and malware;; 2 = least privilege;; 1 = speed;; 0 = none.
• EX011 — Shared admin replacement. What replaces the support company's shared admin account?
  Show marking criteria

  Rubric: 3 = named accounts per engineer;; 2 = named;; 1 = vague;; 0 = none.
• EX012 — MFA rollout order. Who gets multi-factor authentication first, and why?
  Show marking criteria

  Rubric: 3 = administrators and field officers, most exposed;; 2 = admins;; 1 = everyone at once;; 0 = none.

Synthesis

Hardened hosts, least privilege, named administrator accounts and multi-factor authentication limit damage.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →