◇ OpenCyber Academy
Technologist · Chapter 6 · English

Chapter 6 — Operating systems and virtualization

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Operating systems and virtualization

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 What an operating system exposes"]
  N2["6.2 Patch and configuration state"]
  N3["6.3 Virtualization and shared fate"]
  N4["6.4 Snapshots for remediation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 What an operating system exposes"]
  N2["6.2 Patch and configuration state"]
  N3["6.3 Virtualization and shared fate"]
  N4["6.4 Snapshots for remediation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 What an operating system exposes]
    |
    v
[6.2 Patch and configuration state]
    |
    v
[6.3 Virtualization and shared fate]
    |
    v
[6.4 Snapshots for remediation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) name the OS artefacts an assessor typically asks for; (2) explain how virtualization changes isolation assumptions; (3) describe why snapshots and golden images matter to remediation; (4) refuse requests that imply live intrusion of a production hypervisor without provider permission.

6.1 What an operating system exposes

An OS holds accounts, process lists, listening services, package inventories, logs and configuration files. For authorized assessment these are evidence sources when the agreement allows access. A technologist who understands where each source lives can ask for exports rather than for interactive sessions, which reduces operational risk and still produces checkable artefacts.

OS evidence for TRT guests is package lists, listeners and auth logs collected under the ROE. Priya does not dump process memory for curiosity. Fare appliances stay untouched even when they share a VLAN drawing.

6.2 Patch and configuration state

A supported OS with current patches is different from an unsupported release that no longer receives security updates. Configuration also matters: a service that listens on every interface, a password stored in a cleartext file, a firewalled host with an unused management port left open. These are configuration facts, not exploit recipes, and they appear in findings as evidence of control gaps.

Unsupported guests on the staff VLAN become findings with owners; current patched guests do not. Configuration drift — open RDP that lab_ports would mark NOT APPROVED elsewhere — is filed with the package state, not as a separate folklore list.

6.3 Virtualization and shared fate

Guests share a hypervisor, storage and sometimes a network fabric. Isolation is a property of the platform's design and of how carefully it is configured. A finding that one guest can reach another guest's management interface is a platform concern, not only a guest-OS concern. Provider terms usually forbid testing the hypervisor from inside a guest; that boundary must be written into every cloud or hosting engagement.

Shared hypervisors mean one noisy test can affect neighbours. ENG-712 rate limits and dry-runs exist partly because TRT hosts sit on shared fabric. Priya notes shared fate in the residual-risk page.

6.4 Snapshots for remediation

When a fix is applied, a snapshot of the known-good state lets operators roll back if the change breaks something. Snapshots also freeze a moment for later review, but they can contain secrets. Store them under the same access rules as other evidence and delete them when the agreement says so.

For ENG-712 the retest plan for 2026-12-08 names the post-fix snapshots of the portal guest, so the retest compares the same build that was fixed. Without them, a dispute over whether F-01 is VALIDATED can turn into an argument about which build was examined. The snapshots are stored and deleted under the same access and retention rules as other evidence.

Worked example

Priya asks the OS team for a package inventory export of the staff-portal VMs, not for a shell. The inventory shows an unsupported library used by a side tool. The finding cites the inventory export as evidence, lists ATT&CK technique T1195 Supply Chain Compromise as the related adversary pattern for later discussion, and recommends an upgrade path. No interactive session was needed.

Synthetic case. The package inventory and unsupported library are invented for TRT.

Errors and limits

A package list is a point-in-time artefact; it can be stale by the next day. Guest access never implies hypervisor access. This chapter does not describe how to escape a virtual machine.

Exercises

Synthesis

Prefer exports, respect the hypervisor boundary, and treat snapshots as both recovery tools and potential secret stores.

Continue studying — chapter 06 of 30

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →