Intro to Computer Security: Operating System Hardening

Hardening of the operating system (OS) involves configuring an OS securely, updating it, creating rules and policies to govern the system in a secure manner, and removing unnecessary applications and services.
The goal of OS hardening is to reduce the chance of a computer operating system becoming vulnerable to attacks.

Disable default user accounts and change default usernames and passwords.
Avoid using default accounts if possible and restrict user access to downloading, installing, and accessing the server/VPN.
Delete unused files and folders and apply the latest patches to secure the system.

Set security policies to prevent user error, which can lead to successful cyberattacks.
Create and update user policies, and ensure all users are aware of and comply with these procedures.
Implement password policies, account lockout policies, and restrict user access.

Default Windows password policies should be updated to ensure stronger passwords.
Recommended password settings include:
- Password length: 8 characters
- Password age: 60 days
- Password history: 12 passwords
- Account lockout duration: 30 minutes
- Account lockout threshold: 3 attempts
- Reset account lockout counter after: 30 minutes

The Windows Registry stores information and settings for software programs, hardware devices, user preferences, and operating system configuration.
Registry settings can be altered to increase computer security.
Restrict null session access, restrict null session access over named pipes, and restrict anonymous access.

Security templates are used to manage group policy and ensure consistency across the organization.
Common security templates include:
- DC security.inf
- Hisecdc.inf
- Hisecws.inf
- Securedc.inf
- Securews.inf
- Setup security.inf

Many security principles apply in Linux as they do in Windows.
Commonalities between Windows and Linux include:
- Default users and policies
- Shutting down unnecessary services
- Configuring the browser securely
- Routinely patching the system
Differences between Linux and Windows include:
- No application should run as the root user
- Complexity of the root password
- Disable all console-equivalent access for regular users
- Hide system information

Patches have a critical role in fixing security holes.
Patch management systems manage and regularly update missing software patches in a network of computers.
Windows and Linux have their own patch update systems.

A computer virus is a type of malicious code or program that alters/harms the way a computer operates and replicates itself to spread to other machines.
Characteristics of a computer virus:
- Self-replicates
- Spreads rapidly
- May or may not have a malicious payload
Classification of threats:
- Malware attack (stands for malicious software)
- Examples of malware: viruses, worms, Trojan horses, adware, spyware, ransomware, bot

Through network connections, copying itself to other hosts on the network
Through email propagation, mailing itself to everyone in the host's address book
Through website delivery, relying on end-user negligence
Multiple vectors for a virus are becoming more common

Software that tries to prevent viruses from infecting machines
Works in two ways:
- Contains a list of known virus files and compares files on the computer to that list
- Monitors the computer for certain types of virus behavior
Can be on-demand or ongoing scanning

Factors to consider when choosing antivirus software:
- Skill (users need to understand how to use it)
- Budget (price)
- Vulnerability (how often is email used or files downloaded?)
Examples of commercial antivirus software:

Additional methods for defending your system:
- Set all browsers to block active code
- Set all user accounts so that they cannot install software or change browser security
- Segregate subnetworks

What to do if your system is infected by a virus:
1. Stop the spread of the virus
2. Remove the virus
3. Find out how the infection started
Stopping the spread of the virus:
- Disconnect the WAN or subnet
- Disconnect vital servers and backup devices
Removing the virus:
- Run antivirus software and update it
- Find removal instructions online
Finding out how the infection started:
- Talk to users of infected machines
- Read online documentation on the virus
- Check activity logs from the machine