5.5.2. OS Security and Secure Protocols
💡 First Principle: The operating system is the platform that all applications run on — its security determines the ceiling for everything above it. A compromised OS means every application on it is compromised. Secure protocols ensure that communications between systems can't be intercepted or manipulated in transit.
Group Policy (Windows) — centralized configuration management for Windows domains. Enforces password policies, disables USB drives, configures firewall rules, deploys software restrictions, and controls hundreds of security settings across all domain-joined systems. Changes propagate automatically, ensuring consistent enforcement without manual intervention on each machine.
SELinux (Security-Enhanced Linux) — mandatory access control framework for Linux. Enforces security policies at the kernel level, restricting what processes can access even if they're running as root. Default deny model — everything not explicitly permitted is blocked. AppArmor is an alternative MAC framework that uses path-based policies and is often considered easier to configure.
Protocol selection matters because insecure protocols transmit data in plaintext, allowing any network observer to read credentials, data, and commands:
| Insecure | Secure Replacement | Why |
|---|---|---|
| Telnet | SSH | Encrypted remote access |
| FTP | SFTP/FTPS | Encrypted file transfer |
| HTTP | HTTPS | Encrypted web traffic |
| SNMPv1/v2 | SNMPv3 | Encrypted, authenticated management (v1/v2c send community strings in cleartext) |
| LDAP | LDAPS | Encrypted directory queries |
| IMAP/POP3 | IMAPS/POP3S | Encrypted email retrieval |
TLS considerations — TLS 1.2 is the minimum acceptable version. TLS 1.0 and 1.1 are deprecated and should be disabled. TLS 1.3 is the current best practice with improved performance (fewer round trips) and security (removed weak cipher suites). Certificate pinning prevents MITM attacks by associating a host with a specific certificate. What a TLS 1.3 session provides: an ephemeral Diffie-Hellman key exchange (ECDHE, e.g., X25519) gives forward secrecy, so recorded traffic cannot be decrypted later even if the server's long-term key is stolen; an AEAD cipher such as AES-256-GCM provides confidentiality and, through its authentication tag, integrity; and the server's CA-signed certificate provides server authentication (RFC 8446). Validating that certificate means checking that the name matches the requested hostname, that each signature verifies up the chain from the leaf through the intermediate to the root, that the root is in the client's trust store, and that none of the certificates has been revoked (CRL/OCSP) (RFC 5280).
⚠️ Exam Trap: SELinux uses mandatory access control — even root is restricted. If a question describes a Linux system where root can't access certain files, SELinux (or AppArmor) is likely the mechanism. Standard Linux permissions use discretionary access control (DAC) where the file owner controls access.
