Endpoint Security Concepts · Topic 1 of 6

Operating System Security on Windows, macOS and Linux

Learn built in security features of Windows, macOS and Linux, host firewalls, command line basics, file permissions and how privilege escalation works.

  • 5 min
In a nutshell
  • Windows Defender is the Windows antivirus, and Windows also has a host firewall.
  • Gatekeeper and FileVault are macOS features.
  • A host based firewall protects one endpoint and adds a layer to network controls.

What it is

Operating system security means using the protection that is built into the computer's own software.

An endpoint is any device that connects to the network, such as a laptop, desktop or phone. Each endpoint runs an operating system, and that system is the first line of defence on the device.

This page covers the main protections in Windows, macOS and Linux, simple command line use, file permissions, and the idea of privilege escalation.

Userstandard accountruns programOperating systemchecks permissionsallows or deniesFileread, write, executeattacker seeks higher rightsAdmin or rootfull control

How it works

Each system combines accounts, permissions and built in tools to limit what code can do.

Built in security features

SystemCommon features
WindowsWindows Defender antivirus (now called Microsoft Defender Antivirus), a host firewall, User Account Control (UAC), BitLocker disk encryption
macOSGatekeeper, which checks apps before they run, FileVault disk encryption, a built in firewall, XProtect malware checks
LinuxUser and group permissions, a firewall such as iptables or ufw, and optional access control modules

A host based firewall runs on the endpoint itself and filters traffic going to and from that one computer. It works alongside the network firewall, as another layer. It can stop an infected neighbour on the same network from reaching the device.

UAC on Windows asks for confirmation when a program wants administrator rights. This limits what a program can do without the user noticing.

Keep the built in protections turned on. Switching off antivirus or the firewall to fix a problem leaves the device exposed.

Command line basics

Administrators use the command line interface (CLI) because it is fast, can be scripted, and is available even when the desktop is not.

PowerShell is the Windows command line and scripting shell. Its commands are called cmdlets and follow a verb and noun pattern.

PS C:\> Get-Process
PS C:\> Get-Service
C:\> ipconfig /all

Get-Process lists running programs and Get-Service lists services. ipconfig /all shows the network settings of the computer.

On Linux and macOS, the shell is often Bash or Zsh in a terminal.

$ ls -l
-rwxr-xr-x 1 alice staff 2048 Mar 3 10:00 backup.sh
$ whoami
alice

File and directory permissions

Permissions say who may read, write or run a file. They apply the principle of least privilege.

On Linux and macOS, permissions are shown as three groups of three letters for the owner, the group and others. The letters are r for read, w for write and x for execute.

Permission stringMeaning
rwxr-xr-xOwner can read, write and run. Group and others can read and run
rw-r-----Owner can read and write, group can read, others have no access

The chmod command changes permissions, and chown changes the owner.

$ chmod 640 report.txt

In 640, each digit is the sum of read (4), write (2) and execute (1). So 6 means read and write, 4 means read only, and 0 means no access. The digits apply to owner, group and others in that order.

On Windows, files on an NTFS drive have permissions such as Full control, Modify, Read and execute, Read, and Write. They are set for users and groups, and the icacls command can show them.

Privilege escalation

Privilege escalation means gaining more rights than you were given. There are two kinds.

  • Vertical escalation moves up, for example from a standard user to administrator or root.
  • Horizontal escalation moves sideways, for example using another normal user's access.

Attackers do this through unpatched flaws, weak passwords, misconfigured permissions, or programs that run with more rights than needed.

Defences are:

  • patching the system and applications
  • using standard accounts for daily work, and an admin account only when needed
  • giving programs and users the least privilege that works
  • using sudo on Linux, so that administrator rights are granted for single commands and logged

What to remember for the exam

Seven facts cover most questions on this topic.

  • Windows Defender is the Windows antivirus, and Windows also has a host firewall.
  • Gatekeeper and FileVault are macOS features.
  • A host based firewall protects one endpoint and adds a layer to network controls.
  • PowerShell is the Windows shell and scripting tool.
  • Linux permissions use read, write and execute for owner, group and others.
  • In chmod 640, the owner gets 6, the group 4 and others 0.
  • Privilege escalation is gaining higher rights, and least privilege reduces the risk.
Exam tip

To read a permission number, add up read as 4, write as 2 and execute as 1 for each of the three digits.

Common mistakes

These four errors are common.

Working as administrator all day. Malware then runs with full rights, so use a standard account for normal work.

Turning off the firewall to troubleshoot. The device stays exposed if it is not turned back on.

Giving everyone full access. Broad permissions let any user or program change or read files.

Mixing up vertical and horizontal escalation. Vertical means higher rights, and horizontal means another user at the same level.

Watch out

Typing a command you do not understand with administrator rights can damage the system. Check what a command does before you run it.

Check yourself

Work through these three questions.

  • What does a host based firewall protect?

    It filters traffic to and from a single endpoint, adding a layer alongside the network firewall.

  • What does chmod 640 report.txt give to the owner, the group and others?

    The owner can read and write, the group can only read, and others have no access.

  • What is privilege escalation?

    It is gaining more rights than you were given, either upward to admin or root or sideways to another user's access.

Topic 1 of 6 in Endpoint Security Concepts

Test yourself on Endpoint Security Concepts

The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.