Operating Systems, Networking, and Security

Concepts
Operating System Types and Market Segments
Operating systems can be categorized by their primary market and intended use:

Business Client: Designed for centrally managed business networks, offering enhanced
security and management features.
Network Operating System (NOS): Primarily used for servers in business networks, providing
services like file sharing, printing, and application hosting.
Home Client: Intended for standalone or small workgroup PCs in home or small office
environments, focusing on user-friendliness and general productivity.
Cell Phone/Tablet: Optimized for handheld devices with touch interfaces, focusing on mobile
applications and connectivity.

Major Operating Systems and Their Features

Microsoft Windows
Market Coverage: Broadly covers all four market segments.
Key Versions: Windows 10/11 (client), Windows Server 2019/2022 (NOS).
Features: Supports touch interfaces (though smartphone integration has been largely
discontinued), shares code between client and server versions.
File Systems:
NTFS (New Technology File System): Proprietary, features journaling (tracking changes
for recovery), snapshots, robust security controls, POSIX compliance, and indexing.
Required for Windows installation. Limited compatibility with non-Windows OS.
FAT32 (File Allocation Table 32): Older system, lacks advanced features, has a 4GB file
size limit. Good for removable media due to broad compatibility.
exFAT (Extended File Allocation Table): A 64-bit variant of FAT designed for removable
media, supporting large files and volumes.

macOS
Origin: Re-developed from a UNIX kernel.
Features: Proprietary graphical interface, free periodic updates. Supports advanced input
devices like the Magic Trackpad but not touch screens. Its tight integration with Apple
hardware limits compatibility with non-Apple devices.
File System: APFS (Apple File System): Proprietary, featuring journaling, snapshots, robust
permissions, and encryption.

UNIX and Linux

UNIX: A foundational operating system family from Bell Labs (late 1960s). Known for its
portable kernel/shell architecture, allowing it to run on diverse hardware.
 Linux:
An open-source kernel derived from UNIX by Linus Torvalds.
Distributions (Distros): Various versions (e.g., SUSE, Red Hat, Fedora, Debian, Ubuntu,
Mint, Arch) that bundle the Linux kernel with different software packages, licensing, and
support models.
Release Models: Standard (often with Long-Term Support - LTS options) and Rolling
Release (continuous updates).
Use Cases: Widely used as desktops (especially in education), servers (dominating web
server market), and embedded systems (IoT).

Chrome OS
Origin: Derived from the Linux kernel (via Chromium). Proprietary.
Target Hardware: Primarily Chromebooks and Chromeboxes, often found in budget and
education markets.
Focus: Emphasizes web applications and a stable browser environment. Can run Android
applications.

Mobile Operating Systems (iOS & Android)

iOS (Apple): Proprietary, UNIX-derived OS for iPhones and iPads. Closed-source with annual
updates.
iPadOS (Apple): A derivative of iOS specifically for newer iPads, offering enhanced
multitasking and stylus support.
Android (Google/Open Handset Alliance): Open-source, Linux-based OS with numerous
versions developed by various hardware vendors.

Operating System Compatibility Issues

Hardware: New OS versions may require different hardware specifications or render older
hardware/drivers incompatible.
Software: Applications are typically coded for specific operating systems. Cross-platform
versions are necessary for broader reach, and the availability of applications (the "app
ecosystem") is crucial for an OS's adoption.
Network: Devices must support common network protocols to communicate effectively.
User Training: New interfaces, workflows, or features may require users to adapt and receive
training.

Vendor Life-Cycle Management

Operating systems and software follow a life cycle:

Beta: Pre-release testing phase.

Supported: Active development with regular patches, upgrades, and support.
Extended Support: Only critical security patches are provided.
End of Life (EOL): No further support or security updates are provided, posing significant
security risks.
Windows Editions and Versions
32-bit vs. 64-bit:
64-bit CPUs can run both 32-bit and 64-bit OSs.
32-bit CPUs can only run 32-bit OSs and are limited to approximately 4GB of RAM.
64-bit Windows requires digitally signed drivers for hardware compatibility.

Desktop Styles: User interface elements (e.g., Start Menu, taskbar) evolve across versions
(e.g., Windows 11's centered taskbar).
Editions:
Home: For domestic or Small Office/Home Office (SOHO) use. Cannot join domain
networks. Limited RAM and multi-CPU support.
Pro/Enterprise/Education:
For business and educational environments. Can join domain networks and offer
advanced management and security features.
Pro: Focuses on small-to-medium businesses (SMBs) with management capabilities.
Pro for Workstations: Enhanced support for high-end hardware.
Enterprise/Education: Full feature sets, typically available through volume licensing.

Key Features (Pro+): Group Policy Editor, BitLocker encryption, Remote Desktop server
capabilities.
Hardware Limits: Higher support for multi-CPU configurations and significantly higher
RAM limits compared to Home editions.

Operating System Installation and Upgrades

Installation Types:
Clean Install: Wipes the drive and installs the OS from scratch, offering the most reliability.
In-place Upgrade: Installs the new OS version over the existing one, preserving data and
applications. Simpler but potentially less stable.
Attended Installation: Manual user input required during setup.
Unattended Installation: Uses a script or answer file for automated setup, ideal for large
deployments.
Image Deployment: Cloning a pre-configured OS installation onto multiple machines,
ensuring consistency.

Boot Methods: Installation can be initiated from Optical Media (CD/DVD), USB Flash Drive,
Network Boot (PXE), or Internet-Based Boot.
Disk Preparation: Partitioning (using MBR or GPT schemes) and formatting (choosing a file
system like NTFS, FAT32, exFAT, APFS) are required before OS installation.
Repair and Recovery:
Recovery Partition: A dedicated partition often containing tools to restore the OS to its
factory state.
System Restore: Reverts system configuration changes to a previously saved restore
point.
Refresh/Reset (Windows): "Refresh" keeps some user data and apps; "Reset" wipes the
drive clean.

Upgrade Considerations: Always check hardware compatibility, application/driver support,

and back up all data before upgrading.
Application Installation and Requirements
System Requirements: Applications specify minimum hardware needs (CPU, RAM, storage,
graphics card) and any required external hardware.
OS Requirements: Applications must be compatible with the target OS version and
architecture (32-bit or 64-bit).
Distribution Methods: Software can be installed from physical media (CD/DVD/USB) or
downloaded from the internet. Always verify the authenticity of downloads and scan for
malware.
Other Considerations: Licensing terms, vendor support availability, user training needs,
potential impact on system performance and operations (e.g., automated deployment via
Group Policy), and security (installing only from trusted sources with verified digital
signatures).

Troubleshooting Windows OS Problems

Boot Process: The sequence of events from power-on to the OS loading: Firmware (POST) ->
Boot Device Selection -> Boot Loader (MBR/GPT) -> Boot Manager (BOOTMGR) -> Boot
Configuration Data (BCD) -> OS Loader (WINLOAD) -> Kernel (NTOSKRNL).
Boot Recovery Tools: Windows Recovery Environment (WinRE) and Startup Repair can help
fix boot issues.
System Restore: Useful for rolling back recent system configuration changes that may have
caused problems.
Driver Rollback: If a recently updated driver causes issues, reverting to a previous version can
resolve the problem.
Troubleshooting Boot Issues: Often involves identifying missing or corrupt system files.
Recovery disks or installation media are essential.
Troubleshooting Profile Issues: Slow user profile loading after login can indicate a corrupt
user profile ([Link]). Rebuilding the profile by copying data (excluding certain files) can
resolve this.
Troubleshooting Performance Issues:
Task Manager: Identify resource-intensive processes (e.g., [Link], Windows Update).
Resource Monitoring: Check for low memory, disk space, or high CPU usage.
Maintenance: Apply updates, defragment drives (if HDD), verify hardware meets
requirements.
Startup Management: Disable unnecessary startup items using msconfig or Task
Manager.
Malware Scans: Run full system scans.
Power Management: Check settings for potential throttling or overheating issues.

Troubleshooting System Fault Issues:

Blue Screen of Death (BSOD): Often caused by faulty hardware or drivers. Note the STOP
error code. Solutions include System Restore, driver rollback, removing recent hardware/
software, and running hardware diagnostics (chkdsk, memory diagnostics).
System Instability/Shutdowns: May indicate overheating, power supply issues, CPU/RAM
problems, or corrupt kernel files. Use Windows Memory Diagnostics and check hardware
seating.
USB Issues: Update drivers, check power management settings (selective suspend), and
ensure sufficient USB controller resources.

Troubleshooting Application/Service Fault Issues: This includes crashing applications,

 services failing to start, or time synchronization problems.

Windows Networking Configuration

Network Connection Types:
Wired (Ethernet): Uses copper (RJ45) or fiber optic cables. Adapters (e.g., Ethernet,
Ethernet2) must match switch settings. Settings usually auto-negotiate. Advanced
adapter properties can be configured via Device Manager or Network & Internet settings.
Wireless (Wi-Fi): Connect via the network status icon. Manually input SSID and credentials
if broadcast is suppressed. Wi-Fi adapter properties are configured via Device Manager.

IP Addressing Schemes:
IPv4: 32-bit address with a 32-bit subnet mask (e.g., [Link] with mask
[Link]). The mask defines the network and host portions.
IPv6: 128-bit address.
Default Gateway: The IP address of the local router used to reach other networks.
DNS Servers: Resolve hostnames to IP addresses.

Configuration:
Static: Manually assigned IP address, subnet mask, gateway, and DNS.
Dynamic (DHCP): Automatic assignment of network configuration.

Windows Client Configuration: IP settings are managed via Network & Internet settings or
[Link]. Default components include "Client for Microsoft Networks" and "Internet Protocol
(IPv4 & IPv6)". DHCP is the default.
Network Location:
Determined by
Windows Defender Firewall
.
Public: Restricts access, hides the host.
Private: Allows host discovery and sharing.

Universal Naming Convention (UNC): \\Host\Path format for accessing network resources.
Windows Defender Firewall: Controls network access by configuring rules and exceptions for
applications and network profiles.
VPN (Virtual Private Network): Creates a secure tunnel over a public network to access a
private network remotely.
WWAN (Wireless Wide Area Network): Internet access via cellular networks (3G, 4G, 5G). Be
mindful of data usage and potentially set the connection as "metered."
Proxy Settings: Can improve performance and security by caching content and controlling
access. Can be configured manually or automatically via scripts. Transparent proxies require
no client configuration.

Troubleshooting Windows Networking

IP Configuration Issues:
Disconnected/Unplugged: Check physical connections or wireless status.
Limited Connectivity: No DHCP response; uses APIPA (169.254.x.y) or alternate IPv4
config.
No Internet Access: Local IP configuration is fine, but internet connection is broken (router
or ISP issue). Windows tests this via [Link].
 Command-Line Tools:
ipconfig: Displays IP configuration.
hostname: Shows the computer's name.
Network Reset: Resets all network adapters and settings.
pathping / tracert: Trace the route and measure latency/packet loss to a destination.
nslookup: Query DNS servers for name resolution.
netstat: Display active network connections, listening ports, and statistics.

Local Network Connectivity (Ping):

1. ping [Link] (loopback): Verifies TCP/IP stack.

2. ping <workstation_IP>: Verifies local IP configuration and checks for IP conflicts.
3. ping <default_gateway_IP>: Verifies local network and router communication.
4. ping <remote_host_IP>: Verifies communication through the router.

Remote Network Connectivity: Use tracert and pathping to identify where connectivity fails
along the path.
Name Resolution: If connectivity works but names don't resolve, suspect DNS issues.
Network Ports: netstat -a -b -n (run as administrator) shows open ports, associated
processes, and connection states.

Windows Security Configuration

Logical Security Controls: Authentication, Authorization, Accounting (AAA).
Access Control Lists (ACLs): Define permissions for users/groups on resources. Implicit
Deny is standard.
Least Privilege: Grant only necessary permissions.
User Accounts: Local (specific to a machine) or Microsoft Account (cloud-synced).
Security Groups: Collections of user accounts for efficient permission management. Built-in
groups include Administrators, Standard Users, Guests.
User Account Control (UAC): Prompts for elevated permissions, preventing unauthorized
changes.
Authentication Methods: Knowledge (password), Possession (token, phone), Inherence
(biometrics). Multifactor Authentication (MFA) combines two or more.
Windows Domains & Active Directory (AD): Centralized management of users, computers,
and security policies via Domain Controllers. Group Policy Objects (GPOs) enforce
configurations.
File Shares:
Workgroup: Peer-to-peer sharing, local management.
Domain: Centralized control via AD.

NTFS vs. Share Permissions: NTFS permissions are more granular and apply to both local
and network access. Share permissions apply only over the network. The most restrictive of
both applies for network access. Best practice: Grant broad Share permissions (e.g.,
"Authenticated Users - Full Control") and manage granular access using NTFS permissions
assigned to security groups.
Inheritance: NTFS permissions can be inherited by subfolders and files.

Managing Windows Shares

Workgroup Setup: Each computer manages its own shares and permissions locally.
 File Share Configuration: Enable Network Discovery and File Sharing. Configure shared
folders with appropriate permissions.
Printer Sharing: Make printers available over the network.
NTFS vs. Share Permissions: NTFS provides finer control. When accessing a share over the
network, the effective permissions are the most restrictive combination of Share and NTFS
permissions.
Domain Setup: Computers join a domain, managed by Domain Controllers. Requires a
computer account in AD. Access is controlled by domain user accounts and groups.

Linux Features
Components: Kernel, distribution (distro) with package manager, shells, utilities, applications.
Shells and Terminals: The shell (e.g., Bash) provides a command-line interface. Terminal
emulators provide the window for the shell. Desktop environments (GNOME, KDE) provide
GUIs.
Command Interface: command [options] [arguments]. Case-sensitive. man command
provides help.
Pipes (|): Redirect output of one command to the input of another.
File System: Unified structure starting from root (/). No drive letters. Follows the File System
Hierarchy Standard (FHS).
Navigation Commands: pwd, cd, ls.
Search Commands: find (locates files based on criteria), grep (searches text content using
patterns).
File Management Commands: cp (copy), mv (move/rename), rm (delete), df (disk free space),
du (disk usage).
User Management: Root (superuser) has full privileges. su switches user, sudo executes
commands with elevated privileges.
File Permissions: Read (r), Write (w), Execute (x) for Owner, Group, Others. Represented
symbolically (rwx) or octally (754).
Package Management: Tools like apt (Debian/Ubuntu) or dnf/yum (Red Hat/Fedora) manage
software installation from repositories.
Process Monitoring: ps shows running processes.
Network Management: Tools like ip (modern interface for network configuration), dig (DNS
lookup), nmcli (NetworkManager command-line).

macOS Features
Interface: Graphical, with a Menu Bar at the top, Dock for applications, and Spotlight for
search. Mission Control provides an overview of open windows.
System Preferences: Centralized settings management.
Security: Accounts (Administrator, Guest), Apple ID integration, Security & Privacy settings for
app permissions.
Keychain: Manages passwords and credentials. iCloud Keychain syncs across devices.
Finder: File manager.
iCloud: Cloud storage and synchronization service.
App Installation: Primarily via the App Store. Downloaded apps (.dmg files) are also common.
Uninstallation usually involves moving the app to the Trash.
Updates: Managed via the App Store or within application menus.
Time Machine: Built-in backup software for creating system and data backups.

SOHO Router Security Configuration

 Router Function: Combines modem, router, switch, and Wi-Fi access point.
Firmware Updates: Crucial for patching vulnerabilities and supporting newer security
standards (e.g., WPA3).
LAN/WLAN Configuration:
Change default SSID and password.
Use strong encryption (WPA2 or WPA3).
Disable WPS (Wi-Fi Protected Setup) if not needed.
Consider disabling SSID broadcast (though this offers minimal security).

Firewall: Enable the built-in firewall. Configure port forwarding/triggering cautiously for
specific services.
Disable Unused Services: Turn off features like UPnP (Universal Plug-and-Play) if not required,
as they can be security risks.
Access Control: Implement MAC filtering (limited security benefit) or use strong Wi-Fi
passwords.

Information Security Fundamentals

Information Security: Protecting data in any format.
CIA Triad:
Confidentiality: Preventing unauthorized disclosure.
Integrity: Ensuring data accuracy and preventing unauthorized modification.
Availability: Ensuring authorized access when needed.

Cybersecurity: Protecting computer systems from attacks.

Hardening: Securing systems by reducing their attack surface.

Vulnerabilities, Threats, and Risk

Vulnerability: A weakness that can be exploited. Examples include unpatched software, weak
configurations, insecure protocols, and weak passwords.
Threat: The potential for a vulnerability to be exploited by a threat actor.
Risk: The likelihood and impact of a threat exploiting a vulnerability.
Exploit: Code that leverages a vulnerability.
Zero-day Vulnerability: A vulnerability unknown to the vendor or for which no patch exists.
Legacy/EOL Systems: Systems no longer supported are highly vulnerable.
BYOD: Bring Your Own Device policies can increase the attack surface if not managed
properly.

Social Engineering
Definition: Manipulating people to gain access or information.
Tactics: Impersonation, dumpster diving, shoulder surfing, tailgating, phishing (including
spear phishing and whaling), vishing (voice phishing), and setting up evil twin Wi-Fi hotspots.

Threat Types
Static Threats: Known threats with signatures (e.g., traditional viruses).
Behavioral Analysis: Identifying threats based on their actions.
External vs. Internal Threats: Differentiating between attackers outside and inside an
organization.
 Footprinting: Gathering information about a network.
Spoofing: Masquerading as a trusted entity (e.g., IP spoofing, email spoofing).
On-path Attacks: Intercepting and potentially altering network traffic.
Denial of Service (DoS/DDoS): Overwhelming a service to make it unavailable. DDoS attacks
use distributed botnets.
Password Attacks: Dictionary attacks, brute force attacks targeting password hashes.
Web Application Attacks: Cross-site Scripting (XSS) and SQL Injection.

Hashing and Encryption Concepts

Encryption: Scrambling data to make it unreadable without a key.
Cryptographic Hash: A one-way function used for integrity checks (e.g., verifying file
downloads).
Digital Signature: Uses asymmetric encryption to verify message authenticity and integrity.
Key Exchange:
Securely sharing encryption keys between parties.
Symmetric Encryption: Uses the same key for encryption and decryption (fast).
Asymmetric Encryption: Uses a public key for encryption and a private key for decryption
(slower, used for key exchange and digital signatures).

Wireless Security Protocols

WEP: Old, insecure.
WPA: Improved over WEP but considered insecure now.
WPA2: Stronger, uses AES encryption. Widely adopted.
WPA3: Latest standard, offering enhanced security features like SAE (Simultaneous
Authentication of Equals) and better protection for open networks.

Wi-Fi Authentication Methods

Open Authentication: No password required. WPA3 Enhanced Open provides encryption.
Personal Authentication (WPA2-PSK/WPA3-Personal): Uses a Pre-Shared Key (PSK) or
passphrase. WPA3-SAE is more secure than WPA2-PSK.
Enterprise Authentication (802.1X): Uses an AAA server (like RADIUS) for centralized
authentication, often with individual user credentials or certificates. Provides stronger
security and scalability.

Workstation Security Best Practices

Passwords: Use long, complex passwords and enforce expiration policies. Secure BIOS/UEFI
with passwords.
Account Management: Apply the principle of least privilege, restrict login times, lock
accounts after failed attempts, and disable unnecessary accounts (Guest).
Disable Autorun: Prevent malware execution from removable media.
Data Encryption: Encrypt data in use, in transit (TLS/SSL), and at rest (BitLocker, EFS).
Patch Management: Regularly update the OS and applications.

Windows Security Settings

User Accounts: Understand the privileges of Administrator, Standard User, and Guest
 accounts.
NTFS vs. Share Permissions: NTFS is more granular and applies locally and over the network.
Share permissions apply only over the network. The most restrictive combination applies.
Allow vs. Deny: Explicit "Deny" permissions override "Allow."
Effective Permissions: The net result of all applied permissions.
BitLocker: Full-disk encryption for data at rest. BitLocker To Go encrypts removable drives.
User Authentication: Local accounts vs. domain accounts authenticated via Active Directory.
Windows Defender: Includes antivirus and firewall components for host-based security.

Mobile Device Security

Policies: Establish clear policies for device usage, security, and data handling.
Screen Locks: Use strong PINs, passwords, or biometrics. Configure failed login restrictions.
Security Software: Install antivirus/anti-malware apps. Keep OS and apps updated.
EMM/MDM: Enterprise Mobility Management solutions enforce security policies, manage
devices (BYOD, COPE, etc.), and control access to corporate resources.
Data Security: Employ device encryption, remote backup, and remote wipe capabilities.
IoT Security: Secure smart devices by updating firmware, changing default credentials, and
isolating them on the network if possible.

Troubleshooting Mobile OS and App Software

Basic Steps: Reboot the device, force stop unresponsive apps, check for updates.
App Issues: Clear app cache, uninstall/reinstall the app, check for OS compatibility.
Connectivity: Troubleshoot Wi-Fi and Bluetooth by checking signal strength, interference, and
configuration.
Factory Reset: A last resort to resolve persistent OS or hardware issues.

Troubleshooting Mobile OS and App Security

Rooting/Jailbreaking: Compromises device security by bypassing OS controls. MDM
solutions can detect and block such devices.
App Source Security: Download apps only from official app stores. Be cautious of sideloading
APKs or using unofficial app stores.
Malware Indicators: Excessive ads, fake security warnings, sluggish performance,
unexpected app behavior, data leaks.
Troubleshooting Steps: Isolate the device (disconnect from network), identify malicious apps,
uninstall them, and potentially perform a factory reset. Ensure security software is active and
updated.