Chapter 6 — Operating systems and virtualization | Technologist Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Operating systems and virtualization

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Operating system basics for security"]
  N2["6.2 Virtual machines"]
  N3["6.3 Virtual networks"]
  N4["6.4 Safe test environments"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Operating system basics for security"]
  N2["6.2 Virtual machines"]
  N3["6.3 Virtual networks"]
  N4["6.4 Safe test environments"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Operating system basics for security]
    |
    v
[6.2 Virtual machines]
    |
    v
[6.3 Virtual networks]
    |
    v
[6.4 Safe test environments]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) harden operating systems; (2) understand virtual machines and networks; (3) isolate test environments.

6.1 Operating system basics for security

Operating systems control which programs run, which users can do what and which services listen on the network. Tomás learns to check running services, open ports and user accounts on a lab machine using built-in tools. Hardening means turning off unneeded services, applying updates, setting strong account policies and enabling the host firewall. The school's file server, for instance, has remote desktop enabled for a supplier who no longer works with the school, which is an unnecessary service and an obvious hardening task.

6.2 Virtual machines

Virtualisation runs several virtual machines on one physical server, each with its own operating system. The school runs its web, print and DNS services as virtual machines on two hosts. Virtualisation saves hardware but concentrates risk: if a host fails or is compromised, all its virtual machines are affected. Tomás notes that the management interface of the virtualisation hosts must be especially protected, since anyone who reaches it can control every server on that host, including starting, stopping and copying them.

6.3 Virtual networks

Virtual machines connect through virtual switches inside the host, which can be linked to physical networks or kept internal. Separation that exists on physical switches must be repeated in virtual ones, or traffic between virtual machines may bypass controls. Tomás checks that the school's virtual switches place the finance server on its own network segment, and finds it shares a segment with the web server. He records this as a finding, since a compromised web server could otherwise reach the finance server directly.

6.4 Safe test environments

Virtualisation also gives Tomás a safe place to practise. He builds a small lab of virtual machines on a college laptop: a firewall, two clients and a server, all on internal virtual networks with no connection to the college or school network. He can test rules, break configurations and restore snapshots without affecting anyone. Isolated labs are how technologists learn safely; experimenting on a live school network would risk disrupting lessons and could breach the placement agreement. He saves a clean snapshot before each exercise.

Worked example

Tomás's hardening checklist for the file server removes remote desktop and two unused services and enables the host firewall.

Synthetic case. Systems are synthetic.

Errors and limits

Separating physical networks while leaving virtual machines on one virtual segment undermines segmentation.

Exercises

EX016 — Virtualisation risk. Why must virtualisation host management be strongly protected? Rubric: 3 = controls all VMs on the host;; 2 = control;; 1 = slow;; 0 = none.
EX017 — Virtual segment finding. What risk does sharing a segment with the web server create for finance? Rubric: 3 = compromised web server could reach finance directly;; 2 = direct access;; 1 = vague;; 0 = none.
EX018 — Lab isolation. Why keep the practice lab disconnected from other networks? Rubric: 3 = avoid disruption and agreement breaches;; 2 = safety;; 1 = speed;; 0 = none.

Synthesis

Hardened hosts, protected virtualisation management and isolated labs support safe, segmented networks.

Continue studying — chapter 06 of 30

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →