UKF COLLEGE OF ENGINEERING AND TECHNOLOGY SCHOOL OF
COMPUTER AND INFORMATION SCIENCE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
PCCCT502-NETWORK AND SYSTEM SECURITY
Module 3: System Security
Part 1: Windows Security
1. Attacks Against Windows Systems
Windows is a primary target for attackers due to its massive enterprise
and consumer market share. Understanding common attack vectors is
critical for defending the ecosystem.
Malware and Ransomware: Malicious software (viruses, worms,
Trojans) exploits system vulnerabilities or user behavior.
Ransomware specifically encrypts user data and demands payment
for the decryption key.
Privilege Escalation: Attackers exploit design flaws or unpatched
vulnerabilities to elevate their access from a standard user account
to NT AUTHORITY\SYSTEM or Administrator.
Credential Dumping: Tools like Mimikatz are used to extract
plaintext passwords or NTLM hashes from the Windows Local
Security Authority Subsystem Service (LSASS) memory.
Active Directory (AD) Attacks: In enterprise environments,
attackers target AD protocols using techniques like Pass-the-Hash
(PtH), Pass-the-Ticket (PtT), or Kerberoasting to move laterally
across a network.
Living off the Land (LotL): Attackers use legitimate, built-in
Windows administrative tools (like PowerShell, WMI, or vssadmin) to
execute malicious commands, making detection difficult for
traditional antivirus software.
2. Installing Applications Safely
The installation phase is a critical gatekeeping moment for OS integrity.
User Account Control (UAC): UAC prevents unauthorized changes
to the operating system. When an application attempts an action
requiring administrative privileges, UAC prompts the user for
consent or credentials, creating a security boundary.
Code Signing and Digital Certificates: Windows checks the
digital signature of an installer. If an application is signed by a
trusted Certificate Authority (CA), it verifies that the code has not
been tampered with since creation.
AppLocker and Software Restriction Policies: Administrators
use AppLocker to define rules based on file paths, publishers, or
hashes, controlling exactly which applications are allowed to
execute on a system.
Windows Sandbox: A lightweight, isolated desktop environment
where users can run untrusted executable files safely without
permanently affecting the host OS.
3. Authentication and Access Control
Windows utilizes a robust framework to verify identity and restrict
resource access.
Authentication Mechanisms
NTLM vs. Kerberos: NTLM (NT LAN Manager) is an older
challenge-response protocol now considered legacy and vulnerable
to relay attacks. Kerberos is the default, highly secure
authentication protocol in Windows domains, utilizing a Key
Distribution Center (KDC) and ticket-based authentication.
Windows Hello for Business: Replaces passwords with strong
two-factor authentication (2FA) consisting of a device-specific PIN or
biometric data (facial recognition, fingerprint).
Access Control Models
Security Identifiers (SIDs): Every user, group, and computer in
Windows has a unique SID. Windows uses SIDs to track identities
within its security subsystem.
Access Control Lists (ACLs): Windows secures objects (files,
folders, registry keys) using ACLs.
o Discretionary ACL (DACL): Identifies users or groups who
are allowed or denied access to an object.
o System ACL (SACL): Controls which access attempts
generate audit logs in the security event log.
4. Upgrades and Patches
Maintaining up-to-date software is the most effective defense against
known exploits.
Windows Update Architecture: Delivers operating system
updates, feature upgrades, and Microsoft product patches.
Patch Tuesday: Microsoft historically releases security patches on
the second Tuesday of every month.
Windows Server Update Services (WSUS) & Endpoint
Manager: In enterprise environments, administrators use these
tools to test, approve, and orchestrate patch deployment across
thousands of machines to avoid operational downtime.
5. Operating Windows Safely
Daily operations should follow strict security baselines to minimize the
attack surface.
Principle of Least Privilege (PoLP): End-users should operate
using standard user accounts rather than local Administrator
accounts for daily tasks like web browsing and emailing.
Windows Defender Antivirus and Firewall: Built-in tools that
provide real-time protection against malware and network-borne
threats.
BitLocker Drive Encryption: Protects data at rest by encrypting
the entire OS volume, neutralizing the threat of physical data theft if
a device is lost or stolen.
Securing Remote Desktop Protocol (RDP): RDP should never be
exposed directly to the public internet. It should be secured behind
a VPN, utilize Network Level Authentication (NLA), and enforce
strong multi-factor authentication.
Part 2: Linux Security
1. Attacks in Linux Systems
Linux dominates cloud infrastructure, servers, and embedded devices,
making its security profile unique.
Rootkits: Malicious code designed to hide its presence and actions
from users and standard administrative tools. Kernel-level rootkits
alter the core OS behaviors, making them incredibly difficult to
detect.
SSH Brute-Forcing: Attackers constantly scan the internet for
open port 22 (SSH) and attempt millions of automated password
combinations to gain entry.
Buffer Overflow Attacks: Exploiting poorly written C/C++
applications on Linux to overwrite memory space, allowing attackers
to inject and execute malicious shellcode with root privileges.
Web Server Exploits: Because Linux hosts the vast majority of
web applications, attackers target vulnerabilities in software stacks
(e.g., Apache, Nginx, PHP, databases) to gain localized code
execution on the Linux host.
2. Physical Security
If an attacker has physical access to a Linux machine, logical security
controls can often be bypassed entirely.
Bootloader Protection (GRUB): By default, an attacker with
physical access can interrupt the GRUB bootloader, append
init=/bin/sh to the kernel parameters, and drop directly into a root
shell without a password. Password-protecting GRUB blocks this
exploit.
BIOS/UEFI Passwords: Prevent unauthorized users from changing
the boot order to load an external OS (like a live Linux USB) to read
internal drives.
Full Disk Encryption (LUKS): Linux Unified Key Setup (LUKS)
ensures that even if an attacker physically steals the hard drive, the
data remains unreadable without the encryption passphrase.
3. Controlling the Configuration
Hardening a Linux system requires strict control over configurations,
services, and logging.
Disabling Unnecessary Services: Every active service represents
a potential vulnerability. System administrators use systemctl to
disable unused services, reducing the system's attack surface.
Secure Log Management: Linux stores logs in /var/log/ (e.g.,
[Link], syslog). Centralized log management (forwarding logs to a
remote SIEM server) ensures that if a system is compromised, an
attacker cannot delete local logs to cover their tracks.
Kernel Hardening via sysctl: The /etc/[Link] file allows
admins to configure kernel parameters at runtime. This can be used
to disable IP forwarding, ignore ICMP broadcast requests, and enable
protection against SYN flood attacks.
4. Authentication and Access Control
Linux uses a distinct, highly modular approach to identity management
and file permissions.
Pluggable Authentication Modules (PAM)
PAM provides a centralized, flexible framework for validating user
identities. It allows administrators to configure authentication policies
across different services (like SSH or local login) without rewriting the
applications themselves. For example, PAM can enforce password
complexity or integrate Multi-Factor Authentication (MFA).
File Permissions and Ownership
Linux uses a traditional Read, Write, and Execute (rwx) permission model
applied to three scopes: User (Owner), Group, and Others.
Permissi Numeric
File Impact Directory Impact
on Value
List files inside
Read (r) View file contents 4
directory
Create/delete files
Write (w) Modify file contents 2
in directory
Execute Run file as a Enter (cd into) the
1
(x) script/program directory
Special Permissions: * SUID (Set Owner User ID): Runs an
executable with the privileges of the file's owner (often root) rather
than the user executing it (e.g., /usr/bin/passwd).
o SGID (Set Group ID): Files created inside a directory inherit
the directory's group ownership.
o Sticky Bit: Ensures only the file owner or root can delete files
within a directory (e.g., the public /tmp directory).
Advanced Access Control: SELinux and AppArmor
Traditional permissions are Discretionary (DAC). If root is compromised,
the whole system is lost. Mandatory Access Control (MAC) systems like
SELinux (Security-Enhanced Linux) or AppArmor enforce kernel-level
policies that restrict what a process can do, even if it runs with root
privileges.
5. Upgrades and Patches
Linux patching relies heavily on central package repositories maintained
by distributions.
Package Managers: Systems use tools like apt (Debian/Ubuntu) or
dnf/yum (RHEL/Fedora) to securely download and verify
cryptographically signed packages.