Chapter 2: Operating Systems & Cyber Security Fundamentals

2.1 Chapter Overview

Operating systems are the foundation of cyber security. Every endpoint, server, laptop, virtual machine and cloud workload runs on an operating system. A cyber security analyst must understand how operating systems manage files, users, processes, services, permissions, logs and security controls.

Windows and Linux are the most important operating systems in enterprise cyber security. Windows is common in business environments, while Linux is widely used for servers, cloud systems, security tools and network infrastructure.

2.2 Learning Objectives

• Explain the role of operating systems in cyber security.
• Identify key Windows and Linux components.
• Understand file systems and important system directories.
• Explain processes, services and startup programs.
• Understand user accounts, groups and permissions.
• Use basic Windows and Linux commands for investigation.
• Recognize common operating system security controls.
• Apply the CIA triad, least privilege and defense-in-depth concepts.

2.3 What is an Operating System?

An operating system is system software that manages hardware, applications, users, files, memory, processes and security controls. It acts as the bridge between users, applications and computer hardware.

2.4 Why Operating Systems Matter in Cyber Security

2.5 Windows Fundamentals for Cyber Security

Windows is widely used in corporate environments. Security analysts must understand Windows users, groups, services, registry, event logs and PowerShell basics.

Windows Command: Show Current User

whoami

Windows Command: Show Network Configuration

ipconfig /all

PowerShell: List Running Processes

Get-Process

PowerShell: List Services

Get-Service

2.6 Windows Event Logs

Windows Event Logs are critical for investigation. They record logins, system changes, application errors and security events.

PowerShell: Search Failed Logons

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10

2.7 Linux Fundamentals for Cyber Security

Linux is widely used for servers, cloud environments and cyber security tools. Analysts must understand users, permissions, directories, processes, services and logs.

Linux Command: Show Current User

whoami

Linux Command: Show System Information

uname -a

Linux Command: Show IP Address

ip addr

Linux Command: List Running Processes

ps aux

2.8 Linux Logs

Linux logs are commonly stored in the /var/log directory. Logs help analysts detect authentication problems, service failures and suspicious activity.

Linux: Search Failed Logins

grep "Failed password" /var/log/auth.log

Linux: View Recent Log Entries

tail -n 50 /var/log/auth.log

2.9 File Systems and Important Directories

A file system organizes how files are stored and accessed. Security analysts must understand where critical files are located and how file permissions protect them.

2.10 Processes and Services

A process is a running program. A service is a background process that provides system or application functionality. Malware often runs as a process or attempts to install itself as a service.

Windows: List Processes

tasklist

Windows: Find Network Connections

netstat -ano

Linux: List Processes

ps aux

Linux: Show Listening Ports

ss -tulnp

2.11 Users, Groups and Permissions

Permissions control who can read, write, execute, modify or delete resources. Weak permissions can expose sensitive files or allow attackers to escalate privileges.

Windows Permissions

Linux Permissions

Linux uses read, write and execute permissions for owner, group and others.

-rwxr-xr--
 |  |  |
 |  |  Others: read only
 |  Group: read and execute
 Owner: read, write and execute

Linux chmod Example

chmod 640 security_report.txt

2.12 Core Cyber Security Concepts

2.13 Operating System Hardening

Hardening means reducing security weaknesses by configuring the operating system securely.

Hardening Checklist

• Disable unnecessary services and startup programs.
• Apply latest security updates and patches.
• Use strong passwords and multi-factor authentication where available.
• Remove unused accounts.
• Restrict administrator/root access.
• Enable system and security logging.
• Enable endpoint protection and firewall.
• Review file and folder permissions.

2.14 Practical Python OS Checks

Python can collect basic OS information for security inventory and automation.

Python: Detect Operating System

import platform

print("Operating System:", platform.system())
print("OS Version:", platform.version())
print("Machine:", platform.machine())
print("Processor:", platform.processor())

Python: List Files in a Folder

from pathlib import Path

folder = Path(".")

for file in folder.iterdir():
    print(file.name)

Python: Check File Exists

from pathlib import Path

log_file = Path("security_log.txt")

if log_file.exists():
    print("Log file found")
else:
    print("Log file missing")

2.15 Interactive Permission Simulator

This simple simulator explains Linux permission numbers.

2.16 Practical Activities

2.17 Interactive Final Assessment Quiz

Each correct answer gives +1 mark. Each wrong answer gives -0.5 mark.

2.18 Chapter Summary

In this chapter, learners studied Windows and Linux fundamentals, file systems, important directories, processes, services, permissions, logs and core security concepts. These skills are essential for endpoint investigation, system hardening and cyber security operations.