Chapter 6 — Operating systems and virtualization

Chapter 6 — Operating systems and virtualization

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Hardening basics"]
  N2["6.2 Virtual machines and containers"]
  N3["6.3 Managing updates"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Hardening basics"]
  N2["6.2 Virtual machines and containers"]
  N3["6.3 Managing updates"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Hardening basics]
    |
    v
[6.2 Virtual machines and containers]
    |
    v
[6.3 Managing updates]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) harden an operating system configuration; (2) explain virtual machines and containers; (3) manage updates across depot devices.

6.1 Hardening basics

Tomás reviews the depot office PCs. Hardening means removing what is not needed and tightening what remains: disabling unused services, removing local administrator rights from daily accounts, turning on disk encryption, enabling the built-in firewall and setting screen locks. He compares each PC with a checklist based on the vendor's security baseline. Two PCs have users with administrator rights, which would let malware install itself freely. He documents changes and tests that the depot's label software still runs before rolling out across sites.

6.2 Virtual machines and containers

Brightwater runs its route-planning tool on a virtual machine in a small server room. Ruth explains that a hypervisor lets several virtual machines share hardware while staying isolated from each other, and that containers share one operating system kernel but separate applications. Isolation is useful but not absolute: a flaw in the hypervisor or kernel can break it. Tomás notes that the route planner's virtual machine and the file server share a host, so patching the host matters for both.

6.3 Managing updates

Tomás lists update sources: Windows updates for PCs, vendor tools for scanners and printers, firmware for switches and the hypervisor. He finds the scanners were last updated eleven months ago because the vendor tool needs a manual step. Sam agrees a monthly update window per depot, outside peak sorting hours, with a rollback plan. Tomás writes a short schedule showing each device type, its update method and its owner. Updates only happen reliably when someone owns them and they fit operations.

Worked example

Tomás hardens office PCs against a baseline, explains virtualization isolation limits and builds a monthly update schedule with owners.

Synthetic case. Devices and schedules are synthetic.

Errors and limits

Hardening can break legacy software. Shared hosts concentrate risk.

Exercises

• EX016 — Admin rights risk. Why remove local administrator rights from daily accounts? Rubric: 3 = malware could install itself freely;; 2 = malware;; 1 = speed;; 0 = none.
• EX017 — Containers versus VMs. How do containers differ from virtual machines? Rubric: 3 = containers share one kernel; VMs each have their own OS on a hypervisor;; 2 = kernel;; 1 = vague;; 0 = none.
• EX018 — Scanner updates. Why were scanners eleven months out of date? Rubric: 3 = the vendor tool needs a manual step;; 2 = manual;; 1 = no updates exist;; 0 = none.

Synthesis

Hardening, understanding isolation and owned update schedules keep operating systems trustworthy.

Continue studying — chapter 06 of 30

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →