Operating System Security

The operating system is where policy meets reality: it decides who can read a file, start a process or install a driver. Attackers aim for OS-level control (privilege escalation, persistence) and defenders rely on OS-level logs and controls. This page covers the concepts for Linux and Windows; the full checklist lives in System Hardening.

Common Building Blocks

• Kernel vs user space: the kernel has full hardware access; applications run with restricted rights and ask the kernel via system calls.
• Accounts: human users, service accounts, and a superuser (root / Administrator, SYSTEM).
• Processes and services: a process is a running program with the identity of the account that started it; services are long-running background processes, a favourite place for persistence.
• Authentication and authorization: see Identity and Access Management; the OS enforces the access control decisions locally.

Linux

Users, groups and permissions

Accounts are in /etc/passwd, password hashes in /etc/shadow (root-readable only), groups in /etc/group. UID 0 is root.

-rwxr-x---  1 alice devs  4096 Oct 25 report.sh
 |||||||||
 |||||||++-- other: no access
 ||||+++---- group (devs): read, execute
 |+++------- owner (alice): read, write, execute
 +---------- file type (- file, d directory, l link)

chmod 640 secrets.conf     # owner rw, group r, others none
chown alice:devs report.sh
id; groups                 # who am I
sudo -l                    # what may I run as root

sudo grants specific commands as root, logged to the auth log; it is preferred to logging in as root. Configure with visudo using least privilege.

SUID/SGID bits make a program run with the owner's (often root) privileges regardless of who starts it. Needed for tools like passwd, but a misconfigured SUID binary is a classic privilege-escalation path (see Privilege Escalation). Audit with find / -perm -4000 -type f 2>/dev/null.

Linux logs and tools

Processes and services: ps aux, top, ss -tulpn, systemctl list-units --type=service. Cron jobs (/etc/crontab, crontab -l) and systemd units are common persistence spots. Mandatory access control add-ons: SELinux and AppArmor.

Windows

Accounts, SIDs and UAC

• Every user, group and computer has a SID (Security Identifier), e.g. S-1-5-21-...-1001; the RID at the end 500 is the built-in Administrator. Permissions are stored against SIDs, not names.
• Local accounts are in the SAM database; domain accounts live in Active Directory.
• UAC (User Account Control) runs administrators with a standard token and prompts before elevating, limiting silent privilege use.
• Special identities: SYSTEM (highest local rights), LocalService, NetworkService.

Permissions

NTFS uses ACLs with entries (ACEs) per user or group: Read, Write, Modify, Full Control, plus inheritance. Share permissions combine with NTFS permissions and the most restrictive result applies.

whoami /all                 REM user, SID, groups, privileges
icacls C:\Data              REM view/set NTFS ACLs
net user / net localgroup administrators

Registry, services and Event Logs

• Registry: hierarchical configuration database (HKLM, HKCU). Autostart keys such as ...\CurrentVersion\Run are classic persistence points; forensic use in THM: AOC Forensics - Registry Furensics.
• Services: services.msc, sc query. Unquoted service paths and weak service permissions lead to escalation.
• Event Logs (eventvwr, wevtutil): Security, System, Application, and PowerShell logs. Key Security event IDs: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process created, 4720 account created, 4732 member added to a group.

Active Directory in two paragraphs

Active Directory (AD) is Microsoft's directory service. A domain controller (DC) stores users, groups, computers and policies in a database and authenticates domain members with Kerberos (and NTLM as fallback). Objects are organised into OUs, domains and forests, and Group Policy (GPO) pushes security settings (password rules, firewall, application control) to every joined machine, which makes AD the central point for both management and enforcement.

Because AD controls identity for the whole estate, compromising it (especially Domain Admins or the krbtgt account) means compromising everything. Defence is tiered administration, protecting privileged groups, monitoring DC events and patching; the attack side is in Active Directory Attacks.

Linux vs Windows

File Systems

Encrypt at rest with LUKS (Linux) or BitLocker (Windows); see full-disk encryption in System Hardening.

Patching and Hardening Essentials

• Patch the OS, kernel and third-party software on a schedule, prioritised by exploitability (process in System Hardening: Patch Management).
• Remove unused software, disable unneeded services and ports; apply a secure baseline (CIS benchmarks).
• Enforce least privilege: no daily use of root/Administrator, restrict sudo and local admin, unique local admin passwords.
• Enable host firewall, disk encryption and secure boot; keep audit logging on and forward logs centrally (SIEM).
• Control change through Change Management.

Key Points

• OS security = accounts, permissions, services, logging, patching.
• Linux: rwx bits, sudo, SUID awareness, /var/log. Windows: SIDs, ACLs, UAC, Registry, Event IDs.
• Active Directory centralises identity and policy, so it is the highest-value target.
• Know where each OS keeps persistence mechanisms and logs; both defenders and attackers look there.

Related

• System Hardening | Identity and Access Management | Networking Fundamentals
• Privilege Escalation | Active Directory Attacks | Malware
• Hands-on: THM: AOC Linux CLI - Shells Bells, THM: AOC Forensics - Registry Furensics, THM: Logs Fundamentals