Operating System Security
Operating system security protects the trusted layer that manages users, programs, devices, and data. You reduce risk by limiting access and exposed features, applying updates, protecting data, monitoring events, and testing that controls still work.
itOperating systems | OpenSkills.info
Intro
Operating System Security
An operating system sits between applications, people, and hardware. That position makes it a trust anchor. It decides which code runs, which identity requests an action, and which resources that identity may use.
Operating system security is the work of keeping those decisions dependable. You configure boundaries, remove avoidable exposure, maintain software, observe behavior, and prepare for failure. No single setting completes that work. Security comes from several controls that support one another.
Start with the protection goals
Most decisions protect one or more of three goals:
- Confidentiality: only authorized identities can read information.
- Integrity: unauthorized identities cannot alter information or system behavior.
- Availability: authorized users can reach the system and its information when needed.
The goals can pull in different directions. A strict policy may block necessary work. A permissive policy may expose sensitive resources. You choose controls from the system's purpose, data, threats, and recovery requirements.
Trust is organized in layers
The boot process establishes the first software state. The kernel then controls memory, processes, devices, and access checks. System services add functions such as remote access, logging, networking, and software updates. Applications and users operate above those layers.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf
Supports
- Confidentiality, integrity, availability, least privilege, and defense principles
- Operating-system patching, service reduction, authentication, resource controls, hardening, and testing
- Logging, protected central retention, backup, recovery, and continuous maintenance
- https://www.kernel.org/doc/html/latest/admin-guide/LSM/index.html
Supports
- Linux Security Module framework and active module discovery
- SELinux, AppArmor, capabilities, and other policy-module context
- https://www.kernel.org/doc/html/latest/security/landlock.html
Supports
- Scoped access control and its distinction from system-call filtering
- https://learn.microsoft.com/en-us/windows/security/
Supports
- Windows trusted boot, security baselines, firewall, BitLocker, identity, and application controls
- https://learn.microsoft.com/en-us/windows/security/book/operating-system-security
Supports
- Windows operating-system protection architecture
- https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/
Supports
- Full-volume encryption and recovery planning on Windows
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/
Supports
- Windows privilege elevation and limits on administrator-level execution
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview
Supports
- Windows application-control choices and approved-code policy
- https://support.apple.com/guide/security/welcome/web
Supports
- Apple secure boot, operating-system integrity, secure updates, app security, and data protection layers
- https://support.apple.com/guide/security/encryption-and-data-protection-overview-sece3bee0835/web
Supports
- Apple encryption and Data Protection architecture
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the Awesome Security and Awesome Cybersecurity Blue Team lists
- https://github.com/sbilly/awesome-security
Supports
- Discovery of Lynis, Fleet, Wazuh, and Rudder as relevant endpoint and operating-system security projects
- https://github.com/fabacab/awesome-cybersecurity-blueteam
Supports
- Cross-check of host-based, device-management, and operating-system telemetry tools
- https://cisofy.com/documentation/lynis/
Supports
- Lynis operating-system coverage, audit purpose, profiles, findings, and interpretation guidance
- https://fleetdm.com/docs/get-started/why-fleet
Supports
- Fleet platform coverage, inventory, patching, device security, and native operating-system evidence
- https://fleetdm.com/docs/get-started/anatomy
Supports
- Fleet reports, policies, osquery data collection, and software inventory
- https://documentation.wazuh.com/current/user-manual/capabilities/sec-config-assessment/index.html
Supports
- Wazuh configuration checks, policy files, misconfiguration findings, and remediation guidance
- https://docs.rudder.io/reference/9.1/usage/configuration_management.html
Supports
- Rudder drift assessment, compliance reporting, and separate audit and enforcement modes
- https://csrc.nist.gov/projects/national-checklist-program
Supports
- Product-specific security configuration checklist discovery
- https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl
Supports
- Known-file metadata as evidence for software identification