Operating System Security

After this lesson, you will be able to: Harden Windows and Linux: user accounts, permissions, disabling services.

Hardening = removing default-on attack surface. Disable services you don't need, lock down accounts, configure firewalls. Most malware is stopped here, not by AV.

Prerequisites:What is Endpoint Security?

User account principles

Don't browse the web as admin/root. Create a low-priv user for daily work, separate admin user for installs. UAC on Windows / sudo on Linux makes the prompt friction visible.

Linux hardening basics

Run as root or with sudo:

bash

# Update system
sudo apt update && sudo apt upgrade

# Enable firewall
sudo ufw enable
sudo ufw default deny incoming

# Disable root SSH
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

# List running services
systemctl list-units --type=service --state=running

Hardening checklist

1
1. Full-disk encryption on.
2
2. Auto-updates enabled.
3
3. Standard (non-admin) daily user.
4
4. Firewall on, default-deny inbound.
5
5. Unnecessary services off.
6
6. Strong password / passphrase.
7
7. MFA on every account that supports it.

←What is Endpoint Security?

Back to End User Device Management

Endpoint Protection Platforms→