Chapter 3 — Operating system administration | Technologist Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Operating system administration

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Users and groups"]
  N2["3.2 Administrator rights"]
  N3["3.3 Services"]
  N4["3.4 Safe investigation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Users and groups"]
  N2["3.2 Administrator rights"]
  N3["3.3 Services"]
  N4["3.4 Safe investigation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Users and groups]
    |
    v
[3.2 Administrator rights]
    |
    v
[3.3 Services]
    |
    v
[3.4 Safe investigation]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) manage users and permissions on common operating systems; (2) control services and startup items; (3) read system information safely.

3.1 Users and groups

In the laboratory, Jamal creates user accounts and groups on both a Windows-style and a Linux virtual machine. He learns that permissions are best assigned to groups, such as reception or finance, rather than to individuals, because people change roles. Ms. Grant shows how a single misconfigured group can give many people access they should not have. At Riverbend, he finds that most staff belong to a group with access to all shared folders. He proposes four groups based on job roles and lists the folders each should reach.

3.2 Administrator rights

Jamal learns the difference between standard and administrator accounts. Administrators can install software, change security settings and read all files. He finds that Riverbend's reception computers log in automatically with an administrator account so staff can install printer drivers. Any malware run from these computers would gain full control. He recommends standard accounts with a printer driver package pre-installed, and the IT manager agrees to change one centre as a trial. After a month, the trial centre reports no problems, and the IT manager plans the change for the other eight centres over the following term.

3.3 Services

Operating systems run background services, and each running service is a possible entry point. Jamal lists services on a laboratory machine and identifies those not needed, such as remote registry access and file sharing on a computer that shares nothing. He disables them and confirms the machine still works. Ms. Grant explains that reducing running services shrinks the attack surface, a basic hardening principle. He records each disabled service in his notebook with the reason, and later uses the list to build a short service checklist for new Riverbend computers, which the IT manager adopts for every new installation.

3.4 Safe investigation

Jamal learns to gather information safely: listing logged-in users, running processes, open network connections and recent log entries without changing anything. He writes these commands in his notebook. Ms. Grant explains that during an incident, careless commands can destroy evidence, so technologists need a standard, read-only set of checks they can run calmly. He tests the checklist on a laboratory machine and confirms that none of the commands changes files, settings or logs. Ms. Grant asks him to add a step recording the date and time of each command, so later readers know exactly when information was collected and in what order.

Worked example

Jamal manages users by group, finds automatic administrator logins at reception, disables unneeded services and builds a read-only investigation checklist.

Synthetic case. Systems are synthetic.

Errors and limits

Automatic administrator logins give any malware full control.

Exercises

EX007 — Group permissions. Why assign permissions to groups? Rubric: 3 = people change roles;; 2 = partly correct;; 1 = vague;; 0 = none.
EX008 — Reception risk. What risk do reception computers have? Rubric: 3 = automatic administrator login;; 2 = partly correct;; 1 = vague;; 0 = none.
EX009 — Service reduction. What does disabling unneeded services do? Rubric: 3 = shrinks the attack surface;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 03 (chapter 03 of 30)

← Chapter 02 · Course chapter index · Chapter 04 →

Continue to the next authored lesson.