An operating system (OS) is the software layer that sits between users/applications and computer hardware. It allocates CPU time, manages memory and files, controls devices, and exposes a consistent interface through system calls and shells/GUI so programs can run efficiently and safely.
- Process & CPU management: create/kill processes, schedule threads on CPUs.
- Memory management: allocate RAM, implement virtual memory, and enforce isolation.
- Device & I/O management: abstract disks, NICs, keyboards via drivers.
- File system management: organize data into files/directories with permissions.
- Security & accounting: authentication, authorization, logging, quotas.
- User & program interface: shells/GUI plus a system-call API for apps.
--
- Kernel: the privileged core that runs in kernel mode, handles scheduling, memory, drivers, filesystems, and IPC.
- Shell: the user-facing interface (CLI or GUI) that interprets commands and launches programs.
- System calls: controlled entry points from user space to kernel services (e.g.,
open, read, execve, CreateProcessW).
Kernel styles you’ll meet in cyber:
- Monolithic kernels (e.g., Linux) pack most services in-kernel.
- Microkernels push services to user space for modularity.
- Hybrid (e.g., Windows, XNU) combine elements of both.
- A process is an executing program with its own virtual address space.
- A thread is a schedulable unit within a process sharing memory.
- Schedulers decide which thread runs next (FCFS, SJF, Priority, Round-Robin, Multilevel Feedback Queue). Understand preemption vs. non-preemption, context switches, and starvation for performance and forensic analysis.
- Virtual memory gives each process its own logical address space, backed by RAM and disk (paging).
- Page replacement algorithms (e.g., FIFO, LRU, Optimal) balance locality and overhead.
- Protection (user vs. kernel mode, page permissions) prevents one process from trampling another.
- OSes expose file systems (e.g., ext4/XFS on Linux, NTFS/ReFS on Windows) with metadata, permissions/ACLs, and journaling for resilience.
- Block I/O (disks, SSDs) uses schedulers; character I/O (terminals) is stream-oriented.
- Disk scheduling (e.g., SCAN/LOOK) and buffering/caching improve throughput.
Typical stages:
- Firmware/UEFI runs hardware init and locates bootloader.
- Bootloader loads the kernel (and initramfs) into memory.
- Kernel initializes subsystems, mounts root FS, starts the first user-space process (
init/systemd or Windows Session Manager).
- Services and the login/session manager start.
User actions happen in user mode; core OS runs in kernel mode.
Security primitives across OSes:
- Identities & groups; permissions (rwx, ACLs), ownership, and privilege boundaries.
- Policy enforcement (e.g., Windows UAC, group policy; Linux DAC + MAC like SELinux/AppArmor).
- Auditing & logging (Windows Event Logs, Linux syslog/journald).
Good hygiene includes least privilege, patching, and strong authentication.
- Virtual machines emulate full hardware to run multiple OS instances.
- Containers (Linux namespaces/cgroups) isolate processes with shared kernels—fast startup and density, great for modern deployments and lab work.
- Desktop: Windows, macOS, Linux distributions—productivity, development, gaming.
- Server: Linux/Windows Server—headless services, performance, and security tuning.
- Mobile: Android/iOS—sandboxed apps, mobile-security paradigms.
- Linux:
useradd, groupadd, passwd -l, files /etc/passwd, /etc/shadow.
- Windows:
net user, net localgroup, Local Users & Groups (MMC).
- Linux:
apt, dnf, yum, apk manage packages and repositories.
- Windows: Winget/Chocolatey for packages; Windows Update service (
wuauserv).
- Linux:
systemctl enable|start <service> (systemd) or service (SysV).
- Windows: Service Control Manager (
sc config/start/stop), Services.msc.
- Linux:
chmod, chown, umasks; ext4/XFS.
- Windows: NTFS ACLs (GUI or
icacls), inheritance, auditing.
- Linux:
/var/log/*, journalctl; logrotate manages rotation/compression.
- Windows: Event Viewer → Application/Security/System logs; retention policies via Group Policy or console.
- Linux:
journalctl -u <svc>, dmesg, top/htop, ss -tulpn, lsof, strace.
- Windows: Event Viewer filters, Resource Monitor, Process Explorer,
Get-WinEvent, Get-Process, netstat, Sysinternals tools.
- Rotate logs, centralize (e.g., syslog → SIEM), and set policies for retention and access. Logrotate is a standard Linux tool to automate rotation.
Linux
- Disable root SSH (
PermitRootLogin no), enforce key-based auth.
- Patch routinely; minimal packages; firewall (
ufw/nftables).
- Correct sensitive perms (e.g.,
/etc/shadow 640, root:shadow).
- Configure logrotate and central logging; monitor auth failures.
Windows
- Enforce NLA for RDP; disable Guest; strong lockout policies.
- Keep Windows Update service enabled; Defender + SmartScreen on.
- Limit local admin use; apply least privilege and AppLocker/WDAC.
- Set Event Log retention and forward to SIEM.
- What is an OS? Interface between user/applications and hardware; manages resources and provides services.
- Process vs. thread? Process has its own address space; threads share that space and are scheduled units.
- What is virtual memory? Abstraction that gives processes isolated address spaces using paging and backing store.
- Kernel vs. shell? Kernel = privileged core; shell = user interface (CLI/GUI) that talks to the kernel via syscalls.
- Monolithic vs. microkernel? Monolithic puts most services in kernel; microkernel keeps minimal kernel, moves services to user space.
Run these in a disposable VM or container.
Linux
# 1) Users & groups
sudo groupadd secops && sudo useradd -m -g secops -s /usr/sbin/nologin secops && sudo passwd -l secops
# 2) Packages (Debian/Ubuntu)
sudo apt-get update -y && sudo apt-get install -y htop && htop --version && sudo apt-get remove -y htop
# 3) Services (systemd)
sudo systemctl enable --now cron || echo "Not available here"
# 4) Log rotation
cat | sudo tee /etc/logrotate.d/custom <<'EOF'
/var/log/custom.log {
weekly
rotate 4
compress
missingok
notifempty
create 0640 root adm
}
EOF
sudo touch /var/log/custom.log && sudo chown root:adm /var/log/custom.log && sudo chmod 0640 /var/log/custom.log
# 5) SSH hardening
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && sudo systemctl restart ssh || true
Windows (PowerShell as Admin)
# 1) Users & groups
net user secops /add /y
net localgroup "Users" secops /add
# 2) Packages via winget (or Chocolatey if present)
winget install --id=7zip.7zip -e; winget uninstall --id=7zip.7zip -e
# 3) Services
sc config wuauserv start= auto
sc start wuauserv
# 4) Event log retention (example: Application log to 64MB)
wevtutil sl Application /ms:67108864
# 5) RDP + NLA recommended (use Group Policy / System Properties > Remote)
- ACL: Access Control List – fine-grained permission entries on objects.
- Context switch: CPU saves/restores state to switch threads.
- Journaling FS: File system that logs changes for crash resilience.
- Kernel/User mode: CPU privilege levels determining allowed operations.
- Paging: Move fixed-size pages between RAM and disk.
- Preemption: Scheduler interrupts a running thread to run another.
- System call (syscall): API boundary from user space into kernel services.
- Include target keywords in H1/H2: “Operating System Basics,” “OS for Cybersecurity,” “Linux vs Windows administration.”
- Add internal links to your Linux CLI, Windows Registry, SIEM/logging, and threat hunting posts.
- Provide a downloadable cheat sheet and lab scripts to boost dwell time and backlinks.
- Mark up the FAQ with JSON-LD (FAQPage) to improve rich results.
